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ABSTRACT 

If  the  U.S.  nuclear  industry  hopes  to  remain  competitive  and  grow  into  the  next 
century,  it  must  be  willing  to  expand  the  goal  of  each  plant  from  safe  performance,  to  safe 
and  economic  performance,  and  apply  this  type  of  thinking  in  all  its  decision  making 
processes.  Economic  performance  can  be  improved  by  increasing  the  plant  capacity 
factor.  However,  the  current  industry  cycle  lengths  of  18  to  24  months  are  limited  in  the 
capacity  factor  gains  they  can  achieve.  The  nuclear  industry  should  consider  focusing  on 
strategies  that  will  extend  operating  cycles  to  48  months  or  more.  Such  a  strategy  should 
address  required  reliability  and  availability  performance,  and  the  surveillance  requirements 
needed  to  attain  a  48  month  goal. 

A  surveillance  strategy  necessary  to  achieve  a  48  month  fuel  cycle  was  developed. 
The  primary  goals  and  objectives  of  the  strategy  were  to  overcome  the  regulatory  and 
investment  protection  barriers  to  extended  cycle  lengths,  provide  a  systematic  surveillance 
resolution  procedure,  and  provide  a  framework  for  addressing  plant  forced  outage  rates. 

As  part  of  the  strategy,  a  detailed  methodology  for  determining  the  surveillance 
performance  options  necessary  to  achieve  a  48  month  fuel  cycle  was  produced.  The 
methodology  was  applied  at  an  operating  Westinghouse  Pressurized  Water  Reactor  to 
demonstrate  the  viability  of  a  48  month  cycle  within  the  nuclear  industry.  Of  the  3108 
regulatory  and  investment  protection  surveillances  studied,  3054  would  likely  support  an 
extended  fuel  cycle.  Initial  recommendations  are  provided  for  resolving  the  remaining  54 
surveillances  which  are  potential  barriers  to  an  extended  cycle.  The  framework  for 
reducing  forced  outage  rates  was  applied  to  a  key  plant  component,  the  Main  Feed  Pump. 
The  framework  concluded  that  the  Main  Feed  Pump  is  likely  to  operate  reliably  over  48 
months  and  not  have  a  significant  impact  on  the  overall  plant  forced  outage  rate. 

One  of  the  key  concepts  discussed  is  the  use  of  the  Limiting  Plant  Event  Frequency 
(LPEF)  as  a  measure  of  expected  loss  in  making  surveillance  program  economic  decisions. 
The  LPEF  includes  the  Core  Damage  Frequency  (CDF),  but  also  recognizes  the 
importance  of  other  transient  endstates  not  affecting  CDF  whose  economic  consequences 
are  so  severe  that  they  must  be  avoided  with  the  same  urgency  applied  to  core  damage. 

Thesis  Supervisor:  Neil  Todreas 
Title:  Professor  of  Nuclear  Engineering 
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Chapter  1  -  Introduction 


1.1  Impetus 

Heading  into  the  21st  century,  the  nuclear  power  industry  is  at  an  important 
crossroads.  Faced  with  increasing  competition  from  the  coal  and  gas  industries  and  a 
much  stricter  regulatory  environment,  the  nuclear  industry  must  focus  on  strategies  that 
will  improve  its  economic  performance  and  make  it  an  attractive  alternative  to  other  major 
electric  power  producing  options.  Only  by  pursuing  these  strategies  will  the  nuclear 
industry  guarantee  its  short  term  survival  and  position  itself  for  long  term  growth. 

Conventionally  fueled  power  plants  start  with  an  immediate  economic  advantage 
over  nuclear  plants  because  of  lower  construction  costs  and  interest  payments,  lack  of  up 
front  decommissioning  costs,  less  regulatory  costs,  and  typically  much  smaller  plant 
staffing  levels.  To  offset  these  built  in  economic  advantages  the  nuclear  industry  must 
maximize  its  one  clear  advantage  over  all  its  major  electric  power  producing  competitors, 
significantly  lower  fuel  costs.  Once  on-line,  a  nuclear  power  plant’s  lower  fuel  costs  can 
give  it  a  decided  economic  advantage  over  other  electric  power  producing  options  if  the 
number  of  operating  or  on-line  days  significantly  outnumber  the  number  of  days  shutdown 
and  it  operates  at  full  capacity. 

The  term  typically  used  to  measure  the  economic  performance  of  nuclear  power 
plants  is  capacity  factor.  Capacity  factor  is  defined  as  the  amount  of  electricity  produced 
over  a  given  time  period  divided  by  the  amount  of  electricity  which  could  have  been 
produced  if  the  plant  had  run  at  100%  power  for  the  entire  period.  Since  nuclear  power 
plants  rarely  operate  at  power  levels  much  below  1 00%  power,  the  major  determinant  in 
capacity  factor  increases  is  the  ratio  of  on-line  days  to  the  sum  of  on-line  and  off-line  days 
during  any  given  time  period.  Off-line  days  are  caused  by  either  forced  or  planned 
outages.  Forced  outages  result  from  either  plant  system  failures  or  operator  errors. 
Planned  outages  are  used  to  perform  refueling  operations,  preventative  and  corrective 
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maintenance,  and  system  testing.  Thus,  any  strategy  designed  to  improve  plant  capacity 
factors,  and  hence  economic  performance,  must  focus  on  maximizing  the  number  of  on¬ 
line  days  during  any  given  time  period.  This  can  be  accomplished  by  focusing  on  three  key 
areas.  These  are: 

•  Increasing  the  cycle  length  between  refuelings 

•  Minimizing  refueling  and  planned  maintenance  outages  times 

•  Reducing  forced  outage  rates 

The  U.S.  nuclear  industry  has  already  realized  some  of  the  potential  economic 
gains  from  longer  operating  cycles.  While  most  plants  operated  on  fuel  cycles  as  short  as 
12  months  just  a  decade  ago,  most  now  operate  on  an  18  month  fuel  cycle  and 
approximately  1 7%  of  the  industry  has  made  or  is  now  making  the  transition  to  24  month 
fuel  cycles.  The  rationale  for  extending  to  a  24  month  cycle  has  been  both  the 
improvement  in  lifetime  capacity  factors  and  the  elimination  of  one  refueling  outage  every 
six  years  as  compared  to  an  1 8  month  cycle.  Although  there  remains  some  skepticism 
within  the  industry  as  to  the  economic  benefits  of  adopting  a  24  month  cycle,  it  is  apparent 
that,  despite  some  initial  setbacks  caused  primarily  by  not  anticipating  all  the  possible 
problems  associated  with  cycle  length  extension,  24  month  fuel  cycles  are  cost  effective. 
Seabrook  Station,  for  example,  estimates  a  net  savings  of  $29  million  over  a  six  year 
period  by  transitioning  from  an  18  month  to  a  24  month  operating  cycle.  Of  this  total 
savings,  $25  million  comes  from  the  elimination  of  one  refueling  outage  every  six  years.* 

Given  the  economic  benefits  already  realized  from  increasing  cycle  lengths  from  12 
months  to  24  months,  the  next  logical  question  is,  are  there  even  more  economic  benefits 
available  by  achieving  even  longer  cycle  lengths  on  the  order  of  48  months  or  more?  This 
hypothesis  was  tested  by  Dalporto/Todreas  in  their  work  entitled  “Achieving  Higher 
Capacity  Factors  in  Nuclear  Power  Plants  Through  Longer  Operating  Cycles”  (MIT- 
ANP-TR-030).  This  research  combined  extensive  interviews  with  industry  leaders  with  a 


'  O’Regan,  Patrick  J..  24  Month  Fuel  Cycle  Evaluation,  December  1994. 
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simplified  economic  analysis.  It  concluded  that  the  potential  benefits  to  the  U.S.  nuclear 
industry  from  longer  operating  cycles  were  significant  and  provided  a  general  strategy  for 
how  cycle  lengths  of  this  magnitude  might  be  achieved.  Given  a  35  day  refueling  outage 
(already  achieved  by  the  best  performing  plants),  the  maximum  theoretical  capacity  factor 
for  various  cycle  lengths,  assuming  no  forced  outages,  would  be  as  shown  in  Table  1.1. 


Capacity  Factor  Potential  Given  a  35  Day  Refueling  Outage 

Table  1  - 1 


■  Cycle  Length 

Max.lmuin  Capedty 

Faictor 

12  Months 

90.5% 

18  Months 

93.5% 

24  Months 

95% 

48  Months 

97% 

Given  that  each  1%  increase  in  capacity  factor  results  in  an  approximate  economic 
benefit  of  $2.19  million/year  (based  on  $0.6  million  per  effective  full  power  day),  research 
efforts  to  develop  a  comprehensive  strategy  for  obtaining  a  48  month  fuel  cycle  are  clearly 
warranted. 

Such  a  strategy  should  address  the  following  areas; 

•  Core  Design  Issues.  A  fuel  core  should  be  designed  which  is  capable  of  a  nominal  48 
month  lifetime.  For  practicality,  it  should  fit  into  existing  nuclear  power  plants  and  the 
fuel  burnup  should  be  maintained  at  or  below  current  licensing  limits. 
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•  Required  Reliability  and  Availability  Performance.  A  strategy  for  attaining  the  plant 
levels  of  reliability  and  availability  needed  to  reduce  forced  outages  and  make  a  48 
month  operating  cycle  economically  attractive  should  be  formulated. 

•  Surveillance  Requirements.  All  maintenance  and  testing  activities,  termed 
surveillances,  which  a  utility  is  currently  required  to  perform  off-line  at  intervals  less 
than  48  months  must  be  made  consistent  with  a  48  month  cycle.  Resolution  can  be  in 
one  of  three  forms:  the  surveillance’s  performance  interval  can  be  extended  to  at  least 
48  months,  the  surveillance’s  performance  mode  can  be  changed  from  off-line  to  on¬ 
line  performance,  or  in  some  cases,  the  surveillance  can  be  eliminated. 

This  thesis  focuses  almost  exclusively  on  the  development  of  a  strategy  to  establish 
surveillance  requirements  which  support  a  48  month  operating  cycle  in  commercial 
Pressurized  Water  Reactors  (PWR).  An  initial  investigation  into  the  reliability  of  one  key 
PWR  component  (the  Main  Feed  Pump),  and  its  possible  impact  48  month  cycle  forced 
outage  rates  is  begun  as  the  groundwork  for  more  extensive  future  work  on  industry 
forced  outage  rates. 

1.2  Goals  and  Objectives 

Important  untested  speculations  against  extended  fuel  cycles  have  always  included 
a  perception  that  the  regulatory  and  economic  barriers  to  making  the  required  regulatory 
based  and  investment  protection  surveillances  compatible  with  longer  operating  cycles 
were  just  too  difficult  to  overcome,  the  inability  of  plant  equipment  to  run  for  extended 
periods  of  time  between  maintenance,  and  the  economic  costs  associated  with  a  longer 
core  life.  But,  the  first  two  arguments  have  never  been  thoroughly  investigated.  If  the 
surveillance  requirements  can  be  adjusted  to  allow  longer  operating  cycles,  and  equipment 
can  be  operated  with  reduced  forced  outage  rates  over  a  48  month  cycle,  the  financial 
penalties  of  operating  a  longer  life  core  could  be  outweighed  by  the  economic  gains 
associated  with  the  increased  plant  capacity  factor.  In  order  to  test  this  hypothesis,  the 
following  primary  goals  and  objectives  have  been  developed: 
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•  Overcome  the  regulatory  and  investment  protection  barriers  to  extended  cycle  lengths 

•  Provide  a  systematic  surveillance  resolution  procedure  that  utilities  can  use  to  prepare 
for  extended  cycle  lengths 

•  Develop  an  initial  framework  for  a  key  plant  component  to  show  how  key  plant 
components  can  operate  for  extended  periods  of  time  between  maintenance  without 
adversely  impacting  the  plant  forced  outage  rate. 

1.2.1  Overcoming  Regulatory  and  Investment  Protection  Barriers 

Too  often  in  the  beginning  phases  of  this  work,  and  during  Dalporto/Todreas’s 
initial  exploration  of  the  possibility  of  extended  cycle  lengths,  nucleaer  industry  personnel 
stated  that  they  thought  that  the  performance  schedule  of  most  of  the  surveillances  they 
performed  could  be  adjusted  to  support  extended  cycle  length  operations.  But,  they  also 
stated  that  the  regulatory  barriers,  imposed  by  the  Nuclear  Regulatory  Commission 
(NRC)  and  other  state  and  local  agencies,  that  had  to  be  overcome  to  move  towards  an 
extended  cycle  were  just  too  difficult  to  change  and  thus  did  not  warrant  attempting  cycle 
lengths  beyond  the  current  maximum  of  24  months.  One  utility  executive,  from  a  very 
successful  plant  already  using  a  24  month  fuel  cycle,  explained  that  he  felt  that  many 
utilities  were  using  the  regulatory  barriers  as  an  excuse  not  to  pursue  longer  cycle  lengths, 
because  they  found  the  work  necessary  to  get  there  “just  too  hard.”  His  experience, 
however,  was  that  if  one  were  willing  to  do  the  work  necessary  to  provide  a  sound 
engineering  and  technical  basis  for  requests  to  the  NRC,  the  perceived  barriers  could  be 
overcome.  This  experience  was  backed  up  by  comments  received  in  interviews  conducted 
with  senior  NRC  management  about  the  48  month  cycle  who  reiterated  the  fact  that 
although  they  thought  it  would  be  difficult,  extended  fuel  cycles  were  possible  and  that 
regulatory  concerns  could  be  satisfactorily  resolved  if  the  proper  technical  case  could  be 
made. 

Chapter  2  of  this  report  presents  a  methodology  for  identifying  the  surveillance 
performance  options  necessary  to  overcome  the  regulatory  and  investment  protection 
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barriers  to  a  48  month  operating  cycle.  The  methodology  can  be  applied  to  each 
surveillance  which  currently  precludes  a  48  month  cycle.  A  decision  chart  identifies  the 
possibilities  for  resolution  with  an  extended  fuel  cycle.  The  methodology  yields  a 
recommendation  that  the  particular  surveillance  is  either  a  candidate  for  on-line 
performance  (Category  A),  a  candidate  for  performance  interval  extension  (Category  B), 
or  a  potential  impediment  to  a  48  month  fuel  cycle  which  requires  further  study  (Category 
C).  Chapter  3  shows  how  this  methodology  could  be  applied  to  resolve  the  entire  set  of 
PWR  plant  surveillances  to  a  48  month  cycle  by  using  the  actual  surveillance  program 
from  an  operating  PWR. 

An  area  of  study  that  should  be  developed  in  the  future  is  the  optimization  of 
surveillance  categorization.  The  methodology  of  Chapter  2  identifies  the  surveillance 
performance  possibilities  for  those  surveillances  currently  precluding  a  48  month  fuel 
cycle.  Some  surveillances  will  be  candidates  for  both  on-line  performance  or  off-line 
performance  at  extended  intervals.  For  surveillances  meeting  these  criteria,  a  decision 
must  be  made  as  to  the  optimum  choice.  A  project  to  develop  a  model  that  could  choose 
the  best  option  for  each  surveillance  to  maximize  the  economic  benefits  of  this  entire  set  of 
surveillances  (given  no  overall  change  in  plant  risk)  should  be  considered. 


1.2.2  Providing  a  Procedure  for  Utilities 

After  developing  a  methodology  for  overcoming  the  regulatory  and  investment 
protection  barriers,  the  thesis  demonstrates  that  the  blueprint  approach  laid  out  in  the 
Surveillance  Resolution  Methodology  in  Chapter  2  is  viable  and  provides  a  procedure  for 
utilities  to  apply  to  their  entire  surveillance  package.  Chapter  3  answers  the  question, 
“What  kind  of  results  can  a  typical  PWR  expect  if  an  extensive  ‘48  Month  Fuel  Cycle 
Surveillance  Resolution  Study’  is  carried  out?”  The  regulatory  and  investment  protection 
surveillance  requirements  of  an  operating  PWR  transitioning  to  a  24  month  cycle  were 
analyzed.  Utilizing  the  methodology  presented  in  Chapter  2  as  a  framework,  surveillance 
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performance  procedures  and  historical  surveillance  records  were  used  to  identify  possible 
candidates  for  on-line  performance  (Category  A),  off-line  performance  at  48  month 
intervals  (Category  B),  and  those  surveillances  which  are  likely  to  preclude  a  48  month 
cycle  and  require  further  study  (Category  C).  Plant  personnel  were  consulted  to  ensure 
surveillance  classifications  were  appropriate.  Ultimately,  expert  judgment  was  relied  upon 
to  assign  final  individual  surveillance  categorizations.  Chapter  4  compiles  all  the 
surveillances  placed  in  Category  C.  Some  discussion  of  the  possible  solutions  to  these 
surveillances  is  provided. 

As  part  of  the  detailed  surveillance  resolution  procedure,  Appendix  A  provides 
detailed  instructions  for  completion  of  technical  evaluations  necessary  to  support 
surveillance  performance  interval  extension.  Additionally,  Chapter  5  provides  an  interval 
extension  justification  that  was  used  as  the  basis  for  an  actual  24  month  interval  extension 
request  at  the  candidate  PWR.  The  format  of  this  example  provides  a  general  guide  to 
utilities  for  how  to  justify  a  surveillance’s  performance  interval  extension.  By  presenting 
an  interval  extension  justification.  Chapter  5  illustrates  the  effort  required  to  complete  a  48 
month  fuel  cycle  surveillance  resolution  project.  For  this  thesis,  complete  justification  of 
all  candidate  surveillances  was  a  prohibitively  large  task.  Also,  it  was  assumed  that  actual 
surveillance  resolutions  will  vary  somewhat  from  plant  to  plant.  Consequently,  complete 
surveillance  justification  is  left;  to  the  individual  utility. 

Finally,  Chapter  7  is  a  compilation  of  management  principles  and  engineering 
points  of  interest  related  to  an  extended  fuel  cycle.  It  answers  the  question,  “What  are 
some  of  the  major  management  and  engineering  issues  which  should  be  kept  in  mind  when 
pursuing  surveillance  requirement  resolution?”  Topics  discussed  include  on-line 
surveillance  scheduling  aids,  methods  of  transition  to  an  extended  cycle,  mid-cycle 
maintenance  outages,  and  others. 
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1.2.3  Initial  Framework  for  Reducing  Forced  Outage  Rates 


Chapter  6  investigates  the  reliability  levels  of  the  Main  Feed  Pump  (MFP)  and  its 
impact  on  plant  forced  outage  rates.  Industry  data  was  compiled  to  provide  an  estimate  of 
the  current  reliability  levels.  Additional  research  and  interviews  with  industry 
representatives,  pump  vendors,  pump  consultants,  and  the  vendors  of  key  pump  sub¬ 
components  was  conducted  to  determine  the  major  failure  mechanisms,  root  causes  of 
failure,  and  recommendations  for  improving  the  reliability  of  the  MFP.  The  primary 
purpose  of  Chapter  6  was  to  develop  a  framework  for  use  in  making  decisions  on  whether 
key  plant  components  could  economically  be  made  to  operate  reliably  for  48  months 
without  adversely  impacting  the  overall  plant  forced  outage  rate.  Chapter  6  lays  the 
groundwork  for  significant  future  work  on  other  key  plant  components  that  are  major 
contributors  to  the  overall  plant  forced  outage  rate. 


1.3  Safe  Performance  versus  Economic  Performance 

There  is  common  misconception  by  some  within  the  nuclear  industry  that  by 
emphasizing  economic  performance,  one  sacrifices  safety  and  vice  versa.  A  close  look  at 
industry  performance  measures  in  the  past  decade  helps  break  that  paradigm.  Following 
the  Three  Mile  Island  accident  in  1979  there  was  an  enormous  increase  in  the  regulation 
and  oversight  of  the  nuclear  industry.  An  even  higher  emphasis  was  placed  on  safe 
operation  in  an  attempt  to  regain  credibility  and  public  confidence.  Yet,  despite  the 
increased  emphasis  placed  on  safe  operation,  which  on  the  surface  might  appear  to  conflict 
with  what  is  needed  to  improve  plant  economic  performance,  the  industry  has  seen  an 
unprecedented  rise  in  the  average  plant  availability  (a  measure  of  economic  performance) 
in  the  last  decade  while  at  the  same  time  the  average  number  of  automatic  scrams  and 
significant  events  per  plant  (measures  of  safe  performance)  have  dropped  significantly. 

This  data,  provided  by  the  NRC,  is  shown  in  figure  1.1. 
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Comparison  of  Plant  Availability  versus 
Scrams  and  Signficant  Events 
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Figure  1-1 

Figure  1 . 1  validates  the  hypothesis  that  as  the  industry  has  become  safer,  as 
indicated  by  the  lower  number  of  significant  events,  the  better  the  plants  perform,  as 
indicated  by  both  the  reduced  number  of  automatic  scrams  and  the  increase  in  availability. 
Assuming  that  the  average  power  plant  earns  about  $600,000  per  effective  full  power  day, 
the  1 1.4%  increase  in  availability  in  1994  as  compared  to  1986  resulted  in  $24.98  million 
in  additional  revenue  in  1994  alone.  The  total  savings  from  1986  to  1994  were  $1 10.45 
million.  In  an  industry  struggling  to  maintain  its  viability  into  the  next  century  this  is  a 
significant  amount  of  additional  revenue  which  can  either  be  returned  to  investors  as 
dividends  or  to  the  end  users  in  the  form  of  lower  electric  rates. 


1.4  Terminology 

The  author  has  attempted  as  much  as  possible  to  use  terminology  that  is  standard 
within  the  nuclear  industry.  For  clarity,  the  following  terms  are  defined  here. 

•  Surveillance  -  A  planned  maintenance  or  test  performed  to  meet  either  regulatory 
requirements  or  for  investment  protection  purposes. 

•  Investment  Protection  -  A  class  of  surveillance,  voluntarily  performed  by  a  utility  to 
protect  components  or  systems  vital  to  plant  operation,  in  which  they  have  invested 
significant  amounts  of  capital. 
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•  Performance  Mode  -  The  standard  technical  specification  definitions  which  describe 
reactor  state  in  terms  of  power  and  temperature.  The  defined  modes  are: 


Mode  1 

Critical(>  5%  Power)  >350“F 

Mode  2 

Critical(<5%  Power)  >350“F 

Mode  3 

Shutdown 

>3  SOT 

Mode  4 

Shutdown 

200-3  SOT 

Mode  5 

Shutdown 

<200T 

Mode  6 

Refueling 

<140T 
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Chapter  2  -  Surveillance  Resolution  Methodology 

2.1.  Introduction 

Some  of  the  methodology  presented  in  this  chapter  was  developed  jointly  between 
myself  and  John  Maurer  who  worked  concurrently  on  a  similiar  thesis  titled  “Surveillance 
Strategy  for  a  Four  Year  Operating  Cycle  in  Commercial  Boiling  Water  Reactors.”, 
February  1996.  The  joint  work  was  conducted  for  the  MIT  Extended  Fuel  Cycle  Project 
team  under  the  ausipices  of  the  MIT  Program  for  Advanced  Nuclear  Power  Studies.  The 
results  of  this  work  are  presented  in  report  MIT-ANP-TR-036  titled  “Surveillance 
Strategy  for  a  Four-Year  Operating  Cycle  in  Commerical  Nuclear  Reactors”,  May  1996.  I 
footnote  the  portions  of  this  chapter  which  were  developed  individually  by  Maurer. 

The  term  ‘surveillance’  is  broad  in  scope.  As  used  in  this  report,  it  defines  a 
variety  of  component  tests,  inspections,  overhauls,  and  preventive  maintenance  activities. 
For  example,  surveillances  include  diesel  generator  operability  tests,  accumulator  integrity 
inspections,  electrical  breaker  overhauls,  and  valve  internals  preventive  maintenance 
activities.  A  typical  nuclear  power  plant  may  conduct  more  than  one  thousand  different 
surveillances  per  fuel  cycle. 

In  order  to  achieve  a  four  year  fuel  cycle,  the  performance  mode  or  the 
performance  interval  of  all  plant  surveillances  performed  at  intervals  less  than  48  months 
while  the  reactor  is  shutdown  must  be  resolved.  There  are  two  fundamental  ways  a 
surveillance  can  be  conducted  to  support  a  48  month  operating  cycle.  The  surveillance 
can  be  performed  while  the  plant  is  at  power  or  the  surveillance  performance  interval  can 
be  extended  to  at  least  48  months. 

This  chapter  discusses  these  two  surveillance  resolution  paths  in  depth  and 
presents  a  methodology  for  determining  the  resolution  options  a  plant  has  for  its  individual 
surveillances.  The  methodology  is  presented  in  the  form  of  two  flowcharts.  The 
flowcharts  lead  to  a  recommendation  for  each  surveillance.  The  recommended  categories 
are  the  following: 


26 


•  Candidate  for  on-line  performance 

•  Candidate  for  performance  interval  extension, 

•  Candidate  for  either  on-line  performance  or  interval  extension,  or 

•  Requires  fiirther  study 

The  chapter  then  proposes  an  optimization  model  for  those  surveillances  which  can 
be  performed  either  on-line  or  at  extended  intervals.  This  model  would  provide  as  an 
output  the  most  economic  combination  of  surveillance  performance  modes  and 
surveillance  performance  intervals  for  the  entire  set  of  surveillances  while  maintaining 
plant  risk  levels  unchanged. 

2.2.  Surveillance  Resolution  Options 

2.2.1  Definitions 

For  the  purposes  of  this  thesis,  surveillances  will  be  placed  in  one  of  three 
categories  which  define  their  probable  compatibility  with  a  48  month  fuel  cycle.  The 
categories  are  defined  as  follows; 

Cate2orv  A  -  Surveillances  which  are  candidates  for  on-line  performance. 

Category  B  -  Surveillances  which  are  candidates  for  performance  interval 
extension  to  48  months. 

Category  C  -  Surveillances  which  are  possible  barriers  to  a  48  month  cycle  and 
require  further  engineering  assessment  to  determine  whether  compatibility  with  a 
48  month  fuel  cycle  can  be  accomplished 


2.2.2  Category  A  -  On-Line  Surveillance  Performance 

During  the  1980’s,  the  U.S.  nuclear  industry  began  a  concerted  effort  to  reduce 
the  length  of  refueling  outages.  The  driving  force  was  the  economic  benefit  from 
returning  plants  to  an  operational  status  as.  soon  as  possible.  Lost  revenues  from  outage 
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days  in  the  nuclear  industry  range  from  $500,000  per  day  to  over  $1,000,000  per  day  for 
utilities  where  nuclear  capacity  is  less  than  or  equal  to  demand.  Given  the  loss  of  revenue, 
efforts  to  reduce  outage  length  by  even  a  few  hours  is  justifiable. 

The  first  mechanism  used  to  achieve  shorter  refuel  outages  was  improved  outage 
planning.  Outage  efficiency  was  improved  by  maximizing  the  number  of  surveillances 
performed  simultaneously,  thus  reducing  the  total  amount  of  time  the  plant  was  off-line. 

Once  outage  efficiency  was  improved,  plant  managers  focused  their  attention  on 
moving  surveillances  to  on-line  performance  modes.  This  resulted  in  a  substantial  increase 
in  the  number  of  surveillances  performed  on-line  and  has  been  the  focus  of  reviews  by 
many  major  nuclear  power  organizations,  including  the  Nuclear  Regulatory  Commission^ 
(NRC). 

Besides  economics,  there  are  many  other  advantages  to  increased  on-line 
surveillance  performance  besides  reduced  outage  lengths.  These  include  the  greater 
attention  which  can  be  afforded  surveillances  performed  on-line,  a  leveled  workload  over 
the  course  of  an  operating  cycle,  and  labor  cost  reductions  from  the  more  efficient  use  of 
full-time  employees  rather  than  more  expensive  outside  contractors.  These  and  other 
factors  are  discussed  below. 

Utilities  should  analyze  the  on-line  performance  possibilities  of  all  surveillances, 
even  those  which  are  not  part  of  the  outage’s  critical  path.  While  justifying  a  surveillance 
for  on-line  performance  may  not  result  in  a  direct  refueling  outage  length  reduction,  it  may 
shorten  the  outage  indirectly  by  freeing  up  time  for  emergent  maintenance  which  often 
becomes  the  critical  path  during  refueling  outages 

During  refueling  outages,  the  number  of  tasks  performed  and  the  increased 
manning  levels  generate  a  degree  of  fatigue  and  complexity  not  experienced  during  normal 
plant  operations.  Senior  engineering  oversight  gets  stretched  thin  when  so  many  people 
are  performing  so  many  different  activities  at  once.  In  contrast,  on-line  surveillance 


^  “Evaluation  of  On-Line  Maintenance”,  Temporary  Instruction  2515/126,  Nuclear  Regulatory- 
Commission,  27  October  94. 
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performance  can  be  afforded  much  more  oversight  and  planning.  Consequently,  on-line 
surveillance  performance  may  result  in  higher  quality  maintenance  and  more  precise  test 
execution.  However,  on-line  maintenance  can  also  increase  the  risk  of  plant  trips  and 
transients  if  poor  maintenance  practices  are  not  corrected. 

Another  human  factor  advantage  associated  with  performing  a  surveillance  on-line 
is  the  increased  probability  of  it  being  performed  by  full-time  plant  employees  rather  than 
more  expensive  outside  contractors.  The  magnitude  of  the  work  to  be  done  during  a 
refueling  outage  and  the  incentive  to  minimize  the  outage  length  means  that  outside 
contractors  are  often  hired  to  perform  a  significant  portion  of  the  surveillances  during  an 
outage.  If  a  surveillance  can  be  performed  on-line,  the  relatively  light  daily  plant  workload 
facilitates  surveillance  performance  by  full-time  plant  personnel.  This  results  in  two  direct 
benefits.  The  first  is  the  increased  attention  afforded  the  surveillance  which  is  likely  since 
the  plant  employee  has  an  ownership  stake  in  the  day  to  day  performance  of  the 
component  or  system.  The  second  direct  benefit  resulting  from  surveillance  performance 
by  plant  personnel  is  increased  component  and  tasking  familiarity.  Reading  the  report  of  a 
surveillance  performed  by  a  contractor  can  only  communicate  a  certain  degree  of 
component  status.  Having  someone  on-site  everyday  who  performed  the  latest  diagnostic 
checks  of  a  component  and  is  intimately  aware  of  the  results  of  those  checks  is  extremely 
valuable.  Such  a  person  is  more  likely  to  understand  potential  failure  mechanisms  and 
remember  trends  in  component  performance. 

Along  with  advantages  in  human  factors  from  performing  a  surveillance  on-line, 
some  surveillances  are  simply  safer  to  do  while  the  plant  is  operating.  For  example,  from 
a  risk  standpoint,  the  Residual  Heat  Removal  (RHR)  System  plays  a  larger  safety  role 
when  the  plant  is  being  shutdown  then  when  it  is  on  the  line.  Therefore,  surveillances 
which  require  the  RHR  system  to  be  inoperable  are  safer  from  a  risk  standpoint  to  perform 
on-line.  In  the  case  of  the  RHR  system,  performing  the  applicable  surveillances  during  an 
outage  could  limit  the  plant’s  ability  to  successfully  cope  with  a  Loss  of  Cooling  Accident 
(LOCA)  and  raise  the  core  damage  frequency  (CDF). 
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Another  incentive  for  justifying  surveillance  on-line  performance  is  that  the 
surveillance  performance  frequency  can  be  increased  if  required.  If  a  component 
demonstrates  poor  performance,  non-intrusive  surveillance  performance  may  assist  in 
predicting  component  failure.  Failure  mechanisms  can  then  be  diagnosed  and  corrected 
before  catastrophic  component  failure  occurs.  In  this  way,  on-line  surveillance 
performance  provides  an  enhanced  component  monitoring  capability.  This  monitoring 
capability  may  ultimately  result  in  improved  equipment  performance.  If  preventive 
maintenance  and  diagnostic  checks  can  be  performed  whenever  a  problem  is  suspected 
rather  than  at  set  intervals  (dictated  by  the  refueling  outages),  then  problems  can  be 
avoided.  Fewer  catastrophic  failures  can  extend  component  life.  For  example,  if  the  oil 
can  be  changed  on-line  whenever  a  motor  exceeds  a  certain  amount  of  run  time  rather  than 
at  set  calendar  intervals  the  motor  will  likely  last  longer. 

While  there  are  many  advantages  to  on-line  surveillance  performance,  it  is  not  risk 
free.  The  safety  and  economic  impacts  of  taking  systems  out  of  service  for  surveillance 
performance  must  be  carefully  considered  prior  to  any  on-line  work.  On-line,  Probabilistic 
Risk  Assessment  (PRA)  based  risk  monitors  can  play  an  important  role  in  pre-surveillance 
planning.  They  greatly  enhance  a  surveillance  scheduler’s  ability  to  identify  potentially 
hazardous  system  configurations.  However,  they  do  not  consider  economic  risks  from  on¬ 
line  surveillance  performance.  Nor  are  they  are  substitutes  for  thorough  preparation  and 
training  of  the  workers  who  will  actually  be  performing  the  surveillance.  Senior 
management  must  ensure  that  everyone  involved  in  on-line  surveillance  performance 
understands  the  possible  complications  of  the  proposed  work.  Surveillance  performance 
can  often  have  a  significant  effect  on  other  seemingly  independent  equipment.  For 
example,  many  instrument  calibrations  are  fairly  routine  when  they  are  performed  during 
an  outage.  But,  if  they  are  performed  on-line,  simply  valving  an  instrument  in  and  out  of 
the  system  can  cause  potentially  dangerous  fluctuations  in  other  instruments  monitoring 
vital  plant  parameters.  Workers  must  thoroughly  understand  critical  system 
interdependencies  such  as  these  when  they  perform  any  surveillance  during  power 
operations. 
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2.2.3  Category  B  -  Performance  Interval  Extension 

During  the  early  years  of  the  nuclear  power  industry,  plant  engineers  had  very  little 
operating  experience  upon  which  to  base  component  reliability  judgments.  Consequently, 
it  was  not  unusual  for  plants  to  shutdown  every  few  months  to  test  vital  systems.  While 
the  industry  has  progressed  beyond  this  ‘test  to  see  if  it’s  broke’  mentality,  many  current 
surveillance  intervals  are  still  indirectly  a  consequence  of  that  reasoning.  Intervals  started 
out  short  and  have  been  gradually  extended  to  meet  plant  requirements,  not  necessarily  as 
determined  by  component  performance.  Consequently,  many  performance  intervals  have 
not  been  optimized.  Instead,  they  have  been  chosen  so  that  they  meet  two  conditions; 
one,  that  they  are  conservative,  and  two,  that  they  support  the  current  plant  operating 
cycle  length.  This  second  condition  is  evident  in  the  non-quantitative  surveillance 
performance  extension  requirements  mandated  by  NRC  Generic  Letter  91-04  for  utilities 
going  from  1 8  to  24  month  fuel  cycles.  Extension  requests  rely  on  expert  opinion  and 
historical  surveillance  data  to  make  the  case  that  a  surveillance  interval  can  be  safely 
extended.  This  method  is  chosen  because  no  quantitative  methodology  for  optimizing 
performance  intervals  currently  exists.  An  optimization  methodology  will  facilitate 
justifying  the  extension  of  performance  intervals  for  surveillances  which  currently  have 
overly  conservative  performance  intervals.  If  a  component  has  been  in  service  for  a 
significant  period  and  has  never  failed  or  been  found  out  of  specification,  it  is  reasonable 
to  question  the  whether  the  performance  interval  can  be  increased.  Surveillance 
performance  requires  time  and  labor.  Resources  are  poorly  allocated  if  they  go  toward 
over-testing  a  proven  component.  Frequent  testing  can  also  result  in  equipment  wear-out. 

Another  new  maintenance  approach  which  will  aid  in  interval  extension 
justifications  is  event-based  (instead  of  time-based)  testing.  Event  based  testing  is  a  subset 
of  performance  based  testing  which  is  widely  regarded  within  the  industry  as  the  wave  of 
the  future  in  maintenance  strategies.  The  theory  is  that  if  failure  mechanisms  are 
predominantly  event-dependent  rather  than  time-dependent,  a  correlation  between  the 
events  in  a  component’s  life  such  as  motor  start-up  and  the  required  surveillance 
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performance  interval  can  be  determined.  The  result  would  be  surveillance  testing 
mandated  every  X  motor  starts  or  valve  strokes  instead  of  every  Y  months  or  years. 

2.3.  Surveillance  Resolution 

This  section  presents  a  surveillance  resolution  procedure.  This  procedure  provides 
a  systematic  method  for  determining  the  resolution  options  for  individual  surveillances. 
Once  the  various  options  are  identified  for  each  surveillance  requirement,  a  proposed 
Economic  Optimization  Model  would  determine  the  most  economical  combination  of 
performance  modes  for  all  the  surveillances  while  maintaining  current  plant  risk  levels 
unchanged.  The  risks  involved  include  those  associated  with  core  damage  as  well  as  other 
undesirable  economic  end-states  such  as  the  need  for  emergency  depressurization  in  a 
boiling  water  reactor  or  feed-and-bleed  in  a  pressurized  water  reactor.  Both  types  of  risks 
will  be  analyzed  by  the  Economic  Optimization  Model.  The  goals  of  the  Economic 
Optimization  Model  will  be  to  provide  a  surveillance  program  that  will; 

•  Provide  maximum  economic  benefit 

•  In  the  worst  case,  be  risk  neutral 

•  Support  a  future  U  S.  nuclear  industry  goal  of  30  day  planned  outages 

•  Support  a  future  U.S.  nuclear  industry  goal  of  40  forced  outage  days  per  cycle 

•  Minimize  the  number  required  of  mid-cycle  maintenance  shutdowns,  with  a 
goal  of  zero  shutdowns 


2.3.1.  Category  A  Resolution  Flowchart 

This  section  discusses  how  to  decide  whether  on-line  surveillance  performance  is 
possible.  In  order  to  accomplish  this,  refer  to  the  Category  A  Resolution  Flowchart  in 
Figure  2.2  (a  flowchart  legend  is  provided  in  Figure  2.1).  Within  this  flowchart,  the 
Boolean  variable  ‘A’  represents  the  event  that  the  surveillance  can  be  performed  on-line. 
If  A  =  True,  then  the  surveillance  is  a  candidate  for  on-line  performance.  If  A  =  False, 
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then  the  surveillance  is  not  a  candidate  for  on-line  performance  and  other  options  must  be 
investigated. 

The  various  decisions  and  processes  of  the  Category  A  Resolution  Flowchart  are 
discussed  in  more  detail  below: 

0  Can  the  surveillance  be  eliminated? 

This  is  a  fundamental  issue  independent  of  whether  the  surveillance  falls  into 
Category  A  or  B.  If  performance  of  the  surveillance  has  no  effect  on  plant  safety 
or  reliability,  then  the  surveillance  should  be  eliminated.  Additionally,  if 
surveillance  performance  has  only  a  small  effect  on  plant  safety  or  economic 
performance  and  could  be  compensated  for  by  increasing  the  frequency  of  selected 
on-line  surveillances,  it  may  be  possible  to  eliminate  the  surveillance  with  no  net 
effect  on  the  overall  CDF  or  economic  performance. 

0  Is  the  component  accessible  at  power? 

If  a  component  is  not  accessible  at  power  either  directly  or  remotely,  modifications 
have  to  be  to  made  to  permit  access  or  the  surveillance  has  to  be  performed 
shutdown.  Inaccessible  equipment  includes  any  components  inside  the  bio-shield 
or  located  below  the  reactor  and  may  also  include  components  that  are  located  in 
high  radiation  areas  where  excess  personnel  exposure  costs  may  make  on-line 
performance  cost  prohibitive. 

0  Can  modifications  be  made  to  render  the  component  accessible? 

If  such  modifications  are  not  possible,  then  the  applicable  surveillance  cannot  be 
performed  on-line,  A  =  False,  and  surveillance  resolution  analysis  should  proceed 
to  the  Category  B  Resolution  Flowchart  which  is  discussed  later. 

0  Can  the  surveillance  be  performed  on-line  by  procedure? 

If  an  on-line  performance  option  already  exists  in  the  current  surveillance 
procedure,  then  a  determination  must  be  made  as  to  why  the  utility  currently 
chooses  to  perform  the  surveillance  off-line.  This  could  include  reasons  ranging 
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from  economic  cost,  a  perceived  risk  of  operator  errors  causing  unplanned 
shutdowns,  increased  man-rem  exposure,  or  no  current  incentive  to  perform  the 
surveillance  on-line  given  current  plant  cycle  and  refueling  lengths.  Whatever  the 
reason,  action  would  have  to  be  taken  to  ensure  that  on-line  surveillance 
performance  does  not  constitute  an  unjustified  risk.  The  risk  issue  is  addressed  in 
the  Economic  Optimization  Model  later  in  this  chapter. 
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^  Maurer,  John  H.  “Surveillance  Strategy  for  a  Four  Yeare  Operating  Cycle  in  Commercial  Boiling  Water 
Reactors."  MIT  Master  of  Science  in  Nuclear  Engineering  Thesis,  February  1996  ,  p.  26. 
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Category  A  Resolution  Flowchart 
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0  Is  the  component  more  risk  significant  at  shutdown'!’ 

Most  components/systems  which  would  fall  into  this  category  are  shutdown  safety 
systems  such  as  the  RHR  system.  In  many  instances,  it  would  be  more  desirable  to 
test  the  system  on-line  to  confirm  its  operability  than  to  wait  for  a  shutdown 
condition  when  its  use  may  be  essential. 

0  Can  the  surveillance  be  performed  in  a  Limiting  Condition  of  Operation  (LCO)? 

LCO’s  are  plant  configurations,  involving  the  unavailability  of  a  particular 
component  or  system,  which  are  allowed  for  short  periods  of  time  by  the  plant 
technical  specifications.  The  purpose  of  an  LCO  is  to  minimize  unnecessary 
shutdowns  in  instances  where  components  or  systems  can  be  safely  tested  on-line 
and  quickly  restored  to  service.  In  the  past,  the  NRC’s  position  was  that  LCO’s 
were  only  to  be  used  for  the  performance  of  corrective  maintenance.  The  NRC 
now  allows  utilities  to  enter  LCO’s  in  order  to  perform  surveillances  on-line 
provided  the  utility  demonstrates  an  acceptable  understanding  of  the  risks 
associated  with  on-line  performance  and  can  perform  the  surveillance  within  an 
allowed  outage  time  (AOT).  Most  utilities  have  a  self  imposed  time  to  perform 
on-line  surveillances  of  1/2  to  3/4  of  the  AOT  to  prevent  having  to  enter  an  action 
statement  which  may  mandate  a  plant  shutdown.. 

0  Are  on-line  testing  substitutes  available? 

On-line  testing  methods  such  as  radiography  or  ultrasonic  testing  may  provide  an 
alternative  to  many  of  the  open  and  inspect  surveillances  resulting  from  the 
American  Society  of  Mechanical  Engineers  (ASME)  Boiler  and  Pressure  Vessel 
Code  Section  XL  Other  testing  substitutes  could  include  vibration  analysis, 
thermography,  or  state  of  the  art  lube  oil  analysis  programs. 

0  Is  redundant  equipment  available? 

If  redundant  equipment  is  available,  the  component  or  system  can  likely  be 
removed  from  service  within  an  LCO  and  the  surveillance  performed  on-line.  This 
is  particularly  applicable  to  instrumentation  where  two  or  more  measurement 
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channels  for  each  parameter  are  provided.  For  example,  the  improved 
Westinghouse  Standard  Technical  Specifications  approved  by  the  NRC  specifically 
allow  the  removal  from  service  of  a  redundant  channel  on  reactor  protective 
systems  for  up  to  four  hours  for  maintenance  or  calibration. 

0  Can  redundant  equipment  be  added? 

The  answer  to  this  question  depends  not  only  on  the  component  and  its  function, 
but  also  on  the  layout  and  space  availability  of  the  plant.  The  cost  of  adding 
redundancy  is  also  a  prime  consideration.  Many  utility  executives  interviewed  for 
this  report  indicated  that  a  utility  must  be  very  confident  that  it  will  see  a  return  on 
investment  in  the  first  three  to  four  years  following  major  plant  modifications 
before  it  will  make  the  up  front  investment  required  to  make  the  modifications. 


If  the  answer  to  any  of  the  last  six  questions  above  is  yes,  then  A  =  True  and  the 
surveillance  is  a  candidate  for  on-line  surveillance.  If  the  answer  to  ^  of  the  last  six 
questions  above  is  no,  then  A  =  False  and  on-line  performance  is  not  an  option. 

Regardless  of  whether  A  =  True  or  False,  the  next  step  is  to  determine  whether  the 
surveillance  is  a  candidate  for  performance  interval  extension.  The  Category  B  Resolution 
Flowchart  is  used  to  make  this  determination.. 

2.3.2.  Category  B  Resolution  Flowchart 

The  next  resolution  task  is  to  decide  whether  a  surveillance  is  a  candidate  for 
performance  interval  extension.  The  Category  B  Resolution  Flowchart  in  Figure  2.3  is 
used  to  make  this  determination.  Within  this  flowchart,  the  Boolean  variable  ‘B’ 
represents  the  event  that  the  surveillance  performance  interval  can  be  extended.  If  B  = 
True,  then  the  surveillance  is  a  candidate  for  performance  interval  extension.  If  B  =  False, 
then  the  surveillance  performance  interval  cannot  be  extended.  The  Boolean  variable  ‘C’ 
represents  the  event  that  the  surveillance  performance  interval  cannot  be  extended  and  the 
surveillance  cannot  be  performed  on-line.  C  =  True  if  A  =  False  and  B  =  False.  If  C  = 
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True,  then  the  surveillance  requires  further  study  to  make  it  compatible  with  a  48  month 
operating  cycle. 

The  various  decisions  and  processes  of  the  Category  B  Resolution  Flowchart  are 
discussed  below. 

0  Can  the  interval  be  extended  on  the  basis  of  a  technical  evaluation? 

This  will  be  the  primary  method  for  justifying  extensions  of  surveillance 
performance  intervals.  NRC  Generic  Letter  91-04  forms  the  basis  for  the  technical 
evaluation.  The  evaluation  must  consider  issues  such  as  surveillance  history, 
corrective  maintenance  history,  preventive  maintenance  history,  time  dependent 
failure  modes,  and  system  engineer  technical  opinions.  If  the  technical  evaluation 
concludes  that  the  surveillance  performance  interval  can  be  safely  extended,  then  B 
=  True  and  resolution  analysis  should  proceed  to  the  Economic  Optimization 
Model. 

0  Can  the  interval  be  extended  based  on  a  lack  of  risk  significance? 

If  extending  the  performance  interval  of  a  particular  surveillance  has  a  relatively 
small  impact  on  the  overall  CDF  or  economic  performance,  then  its  interval  can 
likely  be  extended.  The  increase  in  CDF  or  the  increased  economic  cost  as  a  result 
of  performance  interval  extension  could  be  offset  by  additional  on-line  testing  of 
other  surveillances. 

0  Can  the  interval  be  extended  by  increasing  the  scope  of  the  surveillance? 

If  the  scope  of  a  surveillance  is  increased,  it  may  be  possible  to  perform  it  on  a  less 
frequent  basis.  For  example,  a  particular  pump  is  completely  overhauled  every  10 
years,  but  an  inspection  is  performed  every  24  months  while  the  plant  is  shutdown. 
However,  if  the  pump’s  material  history  showed  that  time  dependent  failures  only 
occurred  at  frequencies  approaching  10  years,  than  the  pump  components  with  the 
highest  time  dependent  failure  rates  could  be  replaced  on  a  more  frequent  basis 
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than  once  every  10  years,  allowing  the  plant  to  justify  extending  the  inspection 
interval  for  the  pump  to  coincide  with  the  replacement  of  these  components. 

0  Can  the  interval  be  extended  by  performing  on-line  monitoring? 

On-line  monitoring  programs  are  increasing  in  use  and  sophistication.  Some  of  the 
current  on-line  monitoring  programs  include  techniques  such  as  vibration  analysis 
of  pumps  and  turbines,  acoustic  flow  detection  and  monitoring  to  measure  valve 
performance,  radiography,  thermography  of  breakers  and  pumps,  and  lube  oil 
analysis.  The  application  of  these  techniques  may  allow  for  actual  inspection 
intervals  to  be  extended.  This  has  the  added  benefit  of  reducing  the  number  of 
times  a  component  must  be  taken  apart  for  inspection  thus  introducing  more 
human  error  into  the  overall  component  performance. 

0  Can  the  interval  be  extended  by  upgrading  the  component? 

Many  surveillance  performance  intervals  are  based  on  the  failure  history  of 
particular  components.  If  a  superior  component  or  system  exists,  performance 
interval  extension  might  be  possible  by  replacing  the  existing  component  with  the 
superior  performer.  Upgrades  of  components  could  also  entail  more  elaborate 
installation  and  alignment  techniques.  For  example,  many  pump  failures  are  due  to 
improper  or  insufficiently  precise  alignments.  An  improvement  in  the  alignment  of 
the  shaft  through  the  use  of  a  modern  alignment  technique  and  proper  mounting  of 
the  pump  could  result  in  improved  component  performance  and  reliability  which 
would  justify  a  surveillance  performance  interval  extension. 


If  the  answer  to  any  of  the  last  four  questions  above  is  yes,  then  B  =  True  and  the 
surveillance  is  a  candidate  for  performance  interval  extension. 

If  the  answer  to  aU  of  the  last  four  question  above  is  no,  then  B  =  False  and  the 
surveillance  cannot  be  performed  at  extended  intervals. 
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Category  B  Resolution  Flowchart 


Input  the  surveillance  which 
precludes  a  48  month  cycle 


Figure  2-3 
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If  A  =  False  and  B  =  False,  then  the  surveillance  is  classified  as  Category  C  and 
requires  further  study  to  resolve  it  consistent  with  an  extended  operating  cycle.  All  other 
surveillances  are  input  into  the  economic  optimization  model. 


2.3.3.  Economic  Optimization  Model 

The  purpose  of  the  Economic  Optimization  Model,  represented  in  the  flowchart  of 
Figure  2.4,  is  to  identify  the  various  surveillance  performance  variables  needed  for  the 
proposed  Economic  Optimization  Engine  which  will  be  discussed  later  in  the  chapter. 
These  variables  are  required  for  the  Engine  to  determine  the  most  economic  combination 
of  surveillance  performance  modes  while  maintaining  current  risk  levels.  Variable 
determination  is  accomplished  in  the  process  boxes  of  the  Economic  Optimization  Model, 
(The  specific  quantification  methods  for  determination  of  the  variables  is  left  as  future 
work.). 

Maintaining  current  risk  levels  unchanged  involves  accounting  for  changes  in  the 
probability  of  core  damage  as  well  as  other  undesirable  economic  end-states.  Limiting 
Plant  Events  (LPE),  which  are  events  that  have  a  significant  economic  impact  on  the  plant, 
define  the  entire  set  of  risks  which  must  be  controlled  to  achieve  economic  success.  In  the 
past,  CDF  has  been  the  risk  indicator  most  frequently  used  by  the  nuclear  industry  for 
making  maintenance  and  operational  decisions.  Yet,  the  sole  use  of  CDF  in  determining 
plant  risk  levels  does  not  adequately  account  for  all  the  important  risk  considerations. 

Core  damage  must  obviously  be  avoided  because  of  the  possible  consequences  to  public 
health  and  safety.  But,  core  damage  must  also  be  avoided  because  it  results  in  a 
significant  economic  impact  on  the  plant,  and  likely  the  entire  nuclear  industry.  Therefore, 
in  reality,  core  damage  is  a  subset  of  the  entire  set  of  LPE’ s  that  have  a  significant 
economic  impact  on  a  plant.  Since  the  rationale  behind  any  length  fuel  cycle  extension 
program  is  improved  economic  performance,  the  Limiting  Plant  Event  Frequency  (LPEF) 
is  the  critical  factor  that  must  be  considered  in  any  surveillance  resolution  program.  Any 
Economic  Optimization  Engine  must  consider  all  the  possible  endstates  that  could  lead  to 
a  LPE.  These  would  include  but  are  not  limited  to: 
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•  Any  endstate  resulting  in  damage  to  the  Main  Turbine  or  Generator  which  would 
require  lifting  of  the  turbine  casing  or  generator  winding  replacement 

•  Any  endstate  resulting  in  severe  damage  to  a  Main  Feed  Pump  requiring  pump  or 
turbine  end  replacement 

•  Any  endstate  resulting  in  damage  to  a  Reactor  Coolant  Pump  where  the  reactor  is 
safely  shutdown  but  loop  draining  is  required  to  remove  and  repair  the  pump 

•  Any  endstate  resulting  in  a  BWR  reactor  depressurization  trip  with  resulting 
containment  contamination 

•  Any  endstate  resulting  in  core  damage 

In  only  the  last  case  is  core  damage  an  endstate.  However,  the  time  required  to 
make  the  repairs  necessary  to  return  the  plant  to  an  electric  producing  (and  revenue 
generating)  state  in  the  first  four  cases  is  so  lengthy  and  costly,  that  occurrence  of  these 
types  of  endstates  must  be  avoided  with  almost  the  same  urgency  applied  to  core  damage. 
Because  LPE’s  are  most  likely  to  occur  as  the  result  of  a  major  plant  transient,  their 
probability  of  occurrence  is  likely  highest  when  the  plant  is  at  power.  Significantly,  LPE’s 
may  involve  systems  not  included  in  the  technical  specifications.  While  methods  to 
determine  changes  in  CDF  have  received  widespread  study  and  are  fairly  well  understood, 
LPEF  changes  have  not  received  the  same  focus  and  require  more  in-depth  study  to 
determine  how  to  quantify  changes  in  the  LPEF. 

Two  restraints  on  the  output  of  the  Economic  Optimization  Engine  would  be  that 
the  mean  and  extreme  LPEF  and  CDF  over  the  course  of  the  cycle  would  be  no  worse 
than  unchanged  as  compared  to  the  original  cycle  length  values.'*  Although  the  events 
contributing  to  the  mean  LPEF  value  include  those  affecting  the  mean  CDF  value,  it  is 
possible  that  improvements  in  the  frequency  of  other  LPE's  could  mask  a  large  increase  in 
the  CDF.  Therefore,  from  a  pure  safety  standpoint,  a  constraint  must  also  be  placed  on 


"  Note  that  if  a  percentage  decrease  or  increase  in  either  the  integrated  LPEF  or  CDF  was  required  or 
desired,  the  Engine  could  be  easily  modified  to  provide  this. 
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the  changes  in  the  mean  CDF.  Another  requirement  would  be  that  the  Engine’s 
recommendations  do  not  contradict  the  appropriate  legal  authority,  i.e.  technical 
specifications  or  other  legal  code.  Finally,  a  limit  would  be  placed  on  both  the 
instantaneous  LPEF  and  CDF  which  could  be  experienced  by  the  plant  so  that  dangerous 
plant  configurations  would  be  avoided. 

In  the  descriptions  below,  variables  are  classified  as  either  “given”  or  “input”.  A 
“given”  variable  concerns  a  surveillance  which  has  only  one  possible  means  of  resolution 
within  a  48  month  operating  cycle.  An  “input”  variable  concerns  a  surveillance  which  has 
more  than  one  possible  means  of  resolution  within  a  48  month  operating  cycle. 

A  detailed  description  of  each  process  box:  (the  numbers  in  parentheses  refer  to 
the  numbers  next  to  the  process  boxes  in  Figure  2.4)  follows. 

□  (1)  Determine  the  changes  in  LPEF  and  CDF  from  surveillance  elimination 

The  elimination  of  a  surveillance  may  increase  both  or  either  of  the  LPEF  and  CDF 
of  the  plant.  This  increase  might  be  offset  by  a  decrease  in  the  LPEF  and/or  CDF  as  a 
result  of  either  a  change  in  the  performance  mode  or  a  change  in  the  performance  interval 
of  some  other  surveillance.  The  changes  in  the  LPEF  and  CDF  as  result  of  surveillance 
elimination  is  a  “given”  variable  to  the  Economic  Optimization  Engine  because  no  other 
performance  option  is  considered  for  surveillance’s  whose  elimination  results  in  large 
economic  savings.  Ultimately,  the  changes  in  the  LPEF  and  CDF  must  be  accounted  for 
in  the  output  of  the  Economic  Optimization  Engine. 

□  (2)  Determine  the  changes  in  LPEF  and  CDF  from  switching  to  on-line  performance 

Switching  to  on-line  surveillance  performance  may  change  the  LPEF  and/or  CDF. 
This  change  may  be  either  an  increase  (as  in  the  case  where  a  plant  transient  resulting  from 
human  error  may  be  more  likely)  or  a  decrease  (as  in  the  case  where  the  surveillance 
involves  a  system  or  component  which  is  more  risk  significant  during  shutdown).  The 
changes  in  the  LPEF  and  CDF  from  switching  to  on-line  performance  for  A  =  True.  B  = 
False  surveillances  is  a  “given”  variable  to  the  Economic  Optimization  Engine  because  off- 
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line  performance  interval  extension  is  not  an  option.  Ultimately,  the  changes  in  the  LPEF 
and  CDF  must  be  accounted  for  in  the  output  of  the  Economic  Optimization  Engine. 

□  (3)  Determine  the  changes  in  LPEF  and  CDF  as  a  function  of  the  performance  interval 

When  the  performance  mode  of  a  surveillance  is  switched  from  off-line  to  on-line, 
increased  surveillance  performance  frequencies  become  an  option.  Increasing 
performance  frequencies,  for  non-destructive  surveillances,  may  result  in  a  decrease  in  the 
LPEF  and/or  CDF  (as  in  the  case  where  a  preventive  maintenance  activity  can  be 
performed  more  frequently).  This  decrease  in  LPEF  and  CDF  may  be  needed  to  offset  a 
possible  increase  in  LPEF  or  CDF  resulting  from  changing  the  performance  mode  or 
performance  interval  of  other  surveillances.  The  changes  in  LPEF  and  CDF  as  a  function 
of  the  performance  interval  for  A  =  True.  B  =  False  surveillances  is  a  “given”  variable  to 
the  Economic  Optimization  Engine  because  off-line  performance  interval  extension  is  not 
an  option.  The  Economic  Optimization  Engine  will  recommend  performance  intervals  for 
all  A  =  True,  B  =  False  surveillances  so  that  the  total  net  changes  in  the  LPEF  and  CDF 
are  zero. 

□  (4)  Determine  the  changes  in  LPEF  and  CDF  from  extending  the  performance  interval 

Extending  the  performance  interval  of  a  surveillances  to  make  it  compatible  with  a 
48  month  fuel  cycle  may  result  in  an  increase  in  the  LPEF  and/or  CDF  (as  in  the  case 
where  the  operation  of  an  integral  safety  system  will  be  verified  less  frequently).  The 
changes  in  LPEF  and  CDF  from  surveillance  performance  interval  extension  for  A  =  False. 
B  =  True  surveillances  is  a  “given”  variable  to  the  Economic  Optimization  Engine  because 
on-line  surveillance  performance  is  not  an  option.  Ultimately,  the  changes  in  the  LPEF 
and  CDF  must  be  accounted  for  in  the  output  of  the  Economic  Optimization  Engine. 

□  (5)  Determine  the  time  required  to  perform  the  surveillance 

During  a  refueling  outage  surveillances  can  be  performed  in  parallel  with  refueling 
operations  without  any  additional  increase  in  outage  length.  It  is  assumed  that  utilities 
already  employ  parallel  path  surveillance  planning  tools  to  help  minimize  outage  lengths. 
Once  the  core  is  completely  refueled,  however,  surveillance  performance  generally 
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Economic  Optimization  Model 


Figure  2-4^ 


^  Maurer,  p.  35. 
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becomes  the  critical  path  towards  outage  completion.  Consequently,  surveillances 
performed  after  completing  core  refueling  are  extremely  expensive.  Therefore,  the  time 
required  to  perform  a  surveillance  during  an  outage  must  be  considered  by  the  Economic 
Optimization  Engine  to  determine  the  combination  of  surveillance  performance  modes 
which  will  minimize  the  number  of  surveillances  performed  after  the  core  has  been 
refueled.  The  time  required  to  perform  A  =  False.  B  =  True  surveillances  is  a  “given” 
variable  to  the  Economic  Optimization  Engine. 

O  (6)  Determine  the  On-Line  Performance  Cost  (Refer  to  Figure  2.5) 

If  a  surveillance  can  be  made  compatible  with  an  extended  operating  cycle  by 
either  performing  it  on-line  or  extending  the  performance  interval,  a  resolution  decision 
must  be  made.  A  key  variable  in  this  decision  is  the  cost  of  performing  the  surveillance 
on-line.  Several  of  the  factors  which  determine  the  cost  of  performing  a  surveillance  on¬ 
line  are  discussed  below. 

□  Labor/Exposure 

A  surveillance  which  is  simple  to  perform  off-line  may  be  extremely 
complex  when  performed  at  power.  Extra  surveillance  preparation  time  may  be 
required  when  performing  a  surveillance  on-line  because  system  interdependencies 
and  contingencies  must  be  considered.  Actual  surveillance  performance  may  have 
to  proceed  at  a  slower  than  usual  pace  to  ensure  no  mistakes  are  made  which 
could  cause  a  plant  transient  or  reactor  trip.  Another  potential  drawback  of  on¬ 
line  surveillance  performance  is  a  possible  increase  in  radiation  exposure  to  plant 
personnel .  (A  figure  of  $10,000  per  man-rem  is  the  figure  used  at  the  plant  where 
research  was  conducted.)  Increased  surveillance  performance  time  and  increased 
radiation  exposure  increase  surveillance  performance  costs. 

□  Modifications 

In  order  to  perform  some  surveillances  on-line  it  may  be  necessary  to  make 
modifications  to  the  existing  plant  configuration  or  additions  to  the  plant 
inventory.  Changes  may  have  to  be  made  simply  to  gain  access  (directly  or 
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remotely)  to  the  component  or  system  involved  in  the  surveillance.  Redundant 
equipment  may  have  to  be  added  so  that  the  component  or  system  to  be  tested  can 
be  taken  out  of  service  while  the  plant  is  at  power.  On-line  testing  equipment  may 
have  to  be  added  to  the  plant’s  inventory.  Any  changes  to  the  plant  configuration 
or  additions  to  the  plant  inventory  increase  on-line  performance  cost. 

□  Planning 

Extra  planning  for  on-line  surveillance  performance  including  additional 
training  of  plant  personnel  will  likely  be  required  if  a  surveillance  is  performed  on¬ 
line.  Normal  testing  line-ups  may  have  to  be  altered  if  a  surveillance  performance 
mode  is  changed  from  off-line  to  on-line.  Such  changes  would  require  analysis  by 
senior  engineers.  The  planning  and  training  required  for  on-line  surveillance 
performance  will  increase  the  cost  of  the  surveillance. 

□  Performance  Frequency 

To  maintain  current  risk  levels  when  an  extended  fuel  cycle  is  adopted,  it 
may  be  necessary  to  perform  on-line  surveillances  more  frequently.  If  the 
frequency  of  surveillance  performance  increases,  the  cost  associated  with  that 
surveillance  increases  proportionally. 

□  Plant  Capacity 

To  perform  some  surveillances  on-line,  a  reduction  in  plant  power  may  be 
required.  For  instance,  some  utilities  perform  on-line  stroke  testing  of  Main  Steam 
Isolation  Valves  (MSIV’s)  by  reducing  plant  power  during  off-peak  periods. 
Reduction  of  plant  power  results  directly  in  loss  of  revenue,  although  the 
alternative,  complete  shutdown  to  perform,  may  be  even  more  expensive.  Many  of 
the  surveillances  which  require  a  reduction  in  plant  power  could  likely  be 
performed  simultaneously,  minimizing  the  loss  of  electricity  production. 
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On-Line  Performance  Cost  Factors 


Extended  Interval  Performance  Cost  Factors 


Figure  2  -  5® 


®  Maurer,  p.  36, 
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□  Licensing 

Changing  the  performance  mode  of  some  surveillances  will  require 
approval  by  the  appropriate  regulatory  authority.  The  mode  change  justification 
packet  will  require  analysis  by  support  engineering.  The  time  spent  producing  the 
analysis  will  be  part  of  the  on-line  performance  cost. 


The  sum  of  these  six  cost  factors  yields  the  overall  on-line  surveillance 
performance  cost.  This  on-line  surveillance  performance  cost  for  A  =  True.  B  =  True 
surveillances  is  an  “input”  variable  because  the  alternative,  extending  the  performance 
interval,  is  also  an  option.  The  Economic  Optimization  Engine  will  ultimately  determine 
the  performance  mode. 


□  (7)  Determine  the  changes  in  LPEF  and  CDF  from  switching  to  on-line  performance 

If  the  surveillance  is  performed  on-line  the  LPEF  and/or  CDF  may  change.  The 
change  may  be  in  either  an  increase  (as  in  the  case  where  a  system  or  component  such  as  a 
Diesel  Generator  is  removed  from  service  for  surveillance  performance)  or  a  decrease  (as 
in  the  case  where  the  surveillance  involves  a  system  or  component  which  is  most  risk 
significant  during  shutdown).  The  changes  in  the  LPEF  and  CDF  from  performing  A  = 
True.  B  =  True  surveillances  on-line  is  an  “input”  variable  to  the  Economic  Optimization 
Engine  because  the  alternative,  extending  the  performance  interval,  is  an  option.  The 
Economic  Optimization  Engine  will  ultimately  determine  the  performance  mode. 

□  (8)  Determine  the  changes  in  LPEF  and  CDF  as  a  function  of  the  on-line  performance 
interval 

If  the  surveillance  is  performed  on-line,  increased  surveillance  performance 
frequencies  are  an  option.  Increasing  performance  frequencies,  as  long  as  the  surveillance 
itself  is  not  a  destructive  examination  of  the  component,  may  decrease  the  LPEF  and/or 
CDF  (as  in  the  case  where  a  preventive  maintenance  activity  can  be  performed  more 
frequently).  The  decrease  in  LPEF  and/or  CDF  may  be  needed  to  offset  the  increases  in 
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LPEF  or  CDF  resulting  from  changing  the  performance  mode  or  performance  interval  of 
other  surveillances.  The  changes  in  LPEF  and  CDF  as  a  function  of  the  performance 
interval  for  A  =  True.  B  -  True  surveillances  is  an  “input”  variable  to  the  Economic 
Optimization  Engine  because  the  alternative,  extending  the  performance  interval,  is  an 
option.  The  Economic  Optimization  Engine  will  ultimately  determine  the  performance 
mode  as  well  as  the  performance  frequency  (if  on-line  performance  is  chosen). 

rm  (9)  Determine  the  Extended  Interval  Performance  Cost  (Refer  to  Figure  2.5) 

If  a  surveillance  can  be  made  compatible  with  an  extended  operating  cycle  by 
either  performing  it  on-line  or  extending  the  performance  interval,  a  resolution  decision 
must  be  made.  A  key  variable  in  this  decision  is  the  cost  of  extending  the  surveillance 
interval  and  performing  the  surveillance  off-line.  Several  of  the  factors  which  determine 
the  cost  of  extending  the  surveillance  interval  and  performing  the  surveillance  off-line  are 
discussed  below. 

□  Labor 

The  amount  of  work  conducted  during  refueling  outages  usually  requires 
the  hiring  of  outside  contract  workers.  Because  they  are  not  full-time  employees 
of  the  plant,  these  workers  constitute  an  avoidable  additional  outage  cost.  If  a 
surveillance  must  be  done  during  the  outage,  extra  contract  workers  may  have  to 
be  hired  to  perform  the  work  to  avoid  increasing  the  length  of  the  outage.  This 
will  be  a  factor  in  the  overall  cost  of  extending  the  surveillance  interval  and 
performing  the  surveillance  off-line. 

□  Modifications 

Performance  interval  extension  may  require  upgrading  a  particular 
component  or  system  to  ensure  it  remains  reliable  over  the  entire  operating  period. 
Redesigning  existing  components  or  buying,  and  installing  new  equipment  is  an 
expense  which  must  be  included  in  the  overall  off-line  extended  interval 
performance  cost. 


50 


□  Planning 

Outage  planning  is  one  of  the  most  specialized  areas  in  the  nuclear  power 
industry.  Outage  planners  work  hard  to  maximize  the  number  of  surveillances 
performed  during  the  core  refueling  period,.  Extending  the  performance  intervals 
of  surveillances  keeps  them  in  the  outage  workscope  and  therefore  increases  the 
complexity  of  outage  planning.  The  larger  the  outage  surveillance  agenda,  the 
larger  is  the  outage  planning  cost. 

□  Performance  Frequency 

The  proper  choice  of  performance  frequency  may  save  money.  If  a 
surveillance  currently  performed  on  a  24  month  refueling  interval  can  be  extended 
to  48  months,  surveillance  performance  costs  will  be  reduced  as  a  result  of  the 
surveillance  being  performed  only  half  the  number  of  times  it  is  performed  on  a  24 
month  refueling  interval. 

□  Power  Production 

Surveillances  which  cannot  be  completed  in  an  outage  before  core  refueling 
is  complete  become  the  critical  path  towards  outage  completion..  The  loss  of 
revenue  due  to  lost  electricity  production  would  be  an  added  cost  of  off-line 
extended  interval  performance.  Depending  on  plant  location,  lost  revenue  per 
effective  full  power  day  can  range  from  $500,000  to  almost  $1,000,000  for  a  plant 
engaged  in  competition. 

□  Licensing 

Changing  the  performance  interval  of  some  surveillances  will  likely  require 
approval  from  the  appropriate  regulatory  authority.  The  interval  extension 
justification  packet  will  require  analysis  by  a  support  engineer.  The  time  this 
engineer  spends  producing  the  packet  will  be  part  of  the  off-line  extended  interval 
performance  cost. 
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The  sum  of  these  six  cost  factors  yields  the  overall  off-line  extended  interval 
performance  cost.  This  off-line  extended  interval  performance  cost  for  A  =  True.  B  = 
True  surveillances  is  an  “input”  variable  because  the  alternative,  performing  the 
surveillance  on-line,  is  also  an  option.  The  Economic  Optimization  Engine  will  ultimately 
determine  the  performance  mode. 


□  (10)  Determine  the  changes  in  LPEF  and  CDF  from  extending  the  performance 
interval 

Extending  the  performance  intervals  of  surveillances  performed  during  outages 
may  increase  the  LPEF  and/or  CDF  (as  in  the  case  where  the  operation  of  an  integral 
safety  system  is  checked  less  frequently).  The  changes  in  LPEF  and  CDF  from 
surveillance  performance  interval  extension  for  A  =  True.  B  =  True  surveillances  is  an 
“input”  variable  because  the  alternative,  on-line  surveillance  performance,  is  an  option. 
The  Economic  Optimization  Engine  will  ultimately  determine  the  performance  mode. 

□  (11)  Determine  the  time  required  to  perform  the  surveillance 

During  a  refueling  outage  surveillances  can  be  performed  in  parallel  with  refUeling 
operations  without  any  additional  increase  in  outage  length.  It  is  assumed  that  utilities 
already  employ  parallel  path  surveillance  planning  tools  to  help  minimize  outage  lengths. 
Once  the  core  is  completely  refueled,  however,  surveillance  performance  generally 
becomes  the  critical  path  towards  outage  completion.  Consequently,  surveillances 
performed  after  completing  core  refueling  are  extremely  expensive.  Therefore,  the  time 
required  to  perform  a  surveillance  during  an  outage  must  be  considered  by  the  Economic 
Optimization  Engine  to  determine  the  combination  of  surveillance  performance  modes 
which  will  minimize  the  number  of  surveillances  performed  after  the  core  has  been 
refueled.  The  time  required  to  perform  A  =  True.  B  =  True  surveillances  is  an  “input” 
variable  because  the  alternative,  on-line  surveillance  performance,  is  also  an  option.  The 
Economic  Optimization  Engine  will  ultimately  determine  the  performance  mode. 
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2.3.4.  Economic  Optimization  Engine 

The  proposed  Economic  Optimization  Engine  would  be  a  computer  based  tool 
which  considers  all  of  the  “given”  and  “input”  variables  of  every  plant  surveillance  and 
determines  the  most  economic  surveillance  performance  mode  combination  while 
maintaining  current  risk  levels.  There  would  be  two  requirements  on  the  Engine’s 
surveillance  performance  mode  combination  conclusions.  First,  the  proposed  change  in 
surveillance  performance  modes  and  performance  intervals  must  be  no  worse  than  risk 
neutral  for  both  the  LPEF  and  CDF  as  compared  to  original  plant  cycle  length.  Second, 
the  proposed  changes  result  in  the  greatest  economic  benefit. 

There  would  be  three  distinct  outputs  of  the  Engine:  (as  represented  in  Figure  2.6) 

1.  The  optimal  performance  mode  of  all  A  =  True,  B  =  True  surveillances 

Since  both  resolution  options  are  possible,  the  Engine  must  determine  which 
option,  in  combination  with  all  other  surveillance  performance  modes,  will  be  the 
most  economic  route  to  follow. 

2.  The  performance  frequency  of  all  A  =  True,  B  =  True  surveillances  selected  for  on-line 
performance 

If  on-line  surveillance  performance  is  selected  for  surveillances  which  also  have  the 
option  of  interval  extension,  a  surveillance  performance  frequency  must  be 
recommended.  The  frequency  may  have  to  be  increased  in  order  to  balance 
increases  in  LPEF  and/or  CDF  resulting  from  the  change  of  the  performance  mode 
or  performance  interval  of  other  surveillances. 

3.  The  performance  frequency  of  all  A  =  True,  B  =  False  surveillances 

The  frequency  may  have  to  be  increased  in  order  to  balance  the  increases  in  LPEF 
and/or  CDF  resulting  from  the  change  of  the  performance  mode  or  performance 
interval  of  other  surveillances. 
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2.4.  Summarv' 

Figure  2.7  summarizes  the  entire  surveillance  resolution  methodology.  First,  a 
determination  is  made  as  to  whether  the  surveillance  can  be  performed  on-line.  Next,  a 
determination  is  made  as  to  whether  the  performance  interv'al  of  the  surveillance  can  be 
extended  to  support  an  extended  operating  cycle.  The  sur\’eillances  which  could  employ 
either  resolution  option  are  input  into  the  Economic  Optimization  Engine.  (The  dotted 
lines  represent  the  “given”  variables  role  in  the  Engine.)  The  Engine  determines  the  most 
economical  performance  mode  and  performance  interval  for  these  surveillances.  The 
constraints  on  this  combination  of  performance  modes  and  intervals  is  that  the 
recommended  plan  must  be  at  least  risk  neutral  for  both  LPEF  and  CDF  as  compared  to 
the  original  surveillance  plan  and  the  recommended  program  yields  the  maximum 
economic  benefit. 

The  tools  necessary  to  determine  changes  in  CDF  as  a  result  of  changes  in 
performance  modes  or  performance  intervals  already  exist  in  software  packages  such  as 
RISKMAN  developed  by  EPRI.  Similar  understanding  of  the  role  of  LPE’s  and  the  LPEF 
on  the  overall  surveillance  structure  requires  significantly  more  study.  Two  other  major 
tasks  still  required  to  make  the  Economic  Optimization  Model/Engine  a  reality  are  the 
development  of  specific  quantification  methods  of  the  cost  factors  illustrated  in  Figure  2.5 
and  the  computer-based  Engine  itself  These  are  both  formidable  jobs,  but  ones  which 
could  play  a  revolutionary  role  in  reducing  the  operation  and  maintenance  costs  of  nuclear 
plants  by  optimizing  the  entire  plant  surveillance  program. 
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Economic  Optimization  Engine 


GIVEN: 

(1)  The  change  in  LPEF/CDF  from  surveillance  elimination 

(2)  The  change  in  LPEF/CDF  from  switching  to  on-line  performance  (A  =  True,  B  =  False) 

(3)  The  change  in  LPEF/CDF  as  a  function  of  the  performance  interval  (A  =  True.  B  =  False) 

(4)  The  change  in  LPEF/CDF  from  extending  the  performance  interval  (A  =  False,  B  =  True) 

(5)  The  time  required  to  perform  the  surveillance  (A  =  False,  B  =  True) 


INPUT: 

All  variables  refer  to  surveillances  with  A  -  True  and  B  =  True 

(6)  The  On-Line  Performance  Cost 

(7)  The  change  in  LPEF/CDF  from  switching  to  on-line  performance 

(8)  The  change  in  LPEF/CDF  as  a  function  of  the  performance  interval 

(9)  The  Extended  Interval  Performance  Cost 

(10)  The  change  in  LPEF/CDF  from  extending  the  performance  interval 

(11)  The  time  required  to  perform  the  surveillance 


OUTPUT: 

1.  The  optimal  performance  mode  of  all  A  =  True,  B  =  True  surveillances 

2.  The  performance  frequency  of  all  A  =  True,  B  =  True  surveillances  selected  for  on-line  performance 

3.  The  performance  frequency  of  all  A  =  True,  B  =  False  surveillances 


Figure  2-6’ 


’’  Maurer,  p.  46. 
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Simplified  Surveillance  Resolution  Flowchart 


Figure  2-7 
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Chapter  3  -  Surveillance  Categorization 


3.1  Regulatory  Based  Surveillances 

For  the  purpose  of  this  study,  surveillances  performed  at  the  candidate  PWR  to 
meet  technical  specification  requirements  are  considered  to  form  the  set  of  regulatory 
based  surveillances  that  must  be  resolved  consistent  with  a  48  month  fuel  cycle.  The  use 
of  the  technical  specifications  as  the  basis  for  the  set  of  regulatory  based  surveillances 
provides  a  simple  method  for  further  classifying  these  surveillances.  Surveillances  were 
classified  and  analyzed  according  to  their  applicable  technical  specification  section.  By 
doing  this,  the  analysis  and  results  presented  in  this  report  are  compatible  with  any 
Westinghouse  PWR  technical  specifications  including  the  improved  Westinghouse 
Standard  Technical  Specifications  which  the  Nuclear  Regulatory  Commission  (NRC)  is 
strongly  advocating.  Administrative  Technical  Specifications  and  Refueling  Technical 
Specifications  are  not  included  in  the  analysis  because  their  specific  requirements  were 
found  to  be  independent  of  cycle  length.  Technical  Requirements,  which  are  also  part  of 
the  licensing  basis,  but  which  only  require  onsite  technical  evaluations  to  change,  were 
included  as  part  of  this  analysis.  The  PWR  technical  specification  sections  which  form  the 
basis  for  the  analysis  are: 

•  In-Service  Testing/Inspection 

•  Section  1  -  Reactivity  Control 

•  Section  2  -  Power  Distribution  Limits 

•  Section  3  -  Instrumentation 

•  Section  4  -  Reactor  Coolant  System  (RCS) 

•  Section  5  -  Emergency  Core  Cooling  Systems  (ECCS) 

•  Section  6  -  Containment 

•  Section  7  -  Plant  Systems 

•  Section  8  -  Electrical  Systems 

•  Technical  Requirements 
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Surveillances  whose  performance  satisfied  more  than  one  technical  specification 
section  were  only  counted  one  time  and  placed  in  the  most  applicable  technical 
specification  section  for  analysis.  For  example,  reactor  coolant  loop  flow  calibrations 
satisfied  technical  requirements  for  both  the  instrumentation  and  reactor  coolant  system 
sections.  Because  the  loop  flow  calibration  requirements  closely  matched  other 
instrument  calibrations  (temperatures,  pressures,  levels)  found  only  in  the  instrumentation 
section,  it  was  placed  in  the  instrumentation  section.  Where  there  was  no  clear 
demarcation  line,  the  surveillance  was  placed  in  the  first  applicable  section.  For  example, 
Engineered  Safeguards  Pump  and  Valve  Response  Time  Testing  satisfied  many  technical 
specification  requirements  including  those  belonging  to  in-service  testing,  plant  systems, 
instrumentation,  and  electrical  systems  sections.  Because  it  could  easily  be  placed  in  any 
of  the  above  sections,  the  first  applicable  section,  in-service  testing  was  chosen. 

There  are  1 772  individual  surveillances  performed  to  meet  the  requirements  in  the 
technical  requirements  and  the  technical  specifications  at  the  candidate  PWR  plant.  These 
1772  individual  surveillances,  currently  matched- to  an  18  month  fuel  cycle,  are  broken 
down  as  shown  in  Table  3.1. 

The  571  surveillances  already  performed  on-line  will  continue  to  be  performed  on¬ 
line  regardless  of  cycle  length  and  therefore  do  not  affect  an  extended  cycle  length.  They 
are  not  be  studied  further  in  this  report.  However,  their  current  performance  intervals 
should  be  evaluated  as  part  of  the  broader  optimization  strategy  discussed  in  Chapter  2  to 
determine  if  their  performance  intervals  are  being  optimized  from  both  a  safety  and 
economic  standpoint.  Analysis  of  the  1201  remaining  surveillances  currently  performed 
while  shutdown  forms  the  basis  for  the  analysis  in  this  chapter.  Of  these  1201 
surveillances,  278  have  performance  intervals  which  are  already  compatible  with  a  48 
month  fuel  cycle,  268  of  which  are  electrical  surveillances. 
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18  Month  Cycle  Regulatory  Based  Surveillance  Breakdown 

Table  3  - 1 


Technical 

Specification  Section 

Total  Surveillances 

Number  On-line 

Number  Off-line 

In-Service  Testing 

229 

60 

169 

Reactivity  Control 

17 

12 

5 

Power  Distribution 
Limits 

17 

16 

1 

Instrumentation 

436 

318 

118 

Reactor  Coolant 

18 

8 

10 

ECCS 

16 

6 

10 

Containment 

81 

25 

56 

Plant  Systems 

51 

41 

10 

Electrical  Systems 

846 

32 

814 

Technical 

Requirements 

61 

53 

8 

Totals 

1772 

571 

1201 

A  discussion  of  each  technical  specification  section  follows.  Utilizing  the 
methodology  and  criteria  developed  in  Chapter  2  of  this  report,  each  section  analyzes 
those  surveillances  currently  performed  shutdown  which  are  applicable  to  that  section,  and 
resolves  their  performance  consistent  with  a  48  month  fuel  cycle.  A  detailed  discussion  of 
the  surveillances  classified  as  Category  A  or  B  is  included.  Those  surveillances  classified 
as  Category  C  surveillances  are  listed  along  with  a  brief  discussion.  A  more  detailed 
discussion  of  all  Category  C  surveillances  with  possible  engineering  solutions  is  provided 
in  Chapter  4.  A  table  comparing  the  current  18  month  surveillance  performance  program 
to  the  recommended  surveillance  performance  program  for  a  48  month  fuel  cycle 
concludes  each  section. 
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3.1.1  In-Service  Testing 


3.1. 1.1  Discussion 

In-service  testing  is  performed  to  meet  the  requirements  of  10CFR50.55.a(g) 
which  requires  all  nuclear  plants  to  set  up  and  maintain  an  in-service  testing  program  that 
meets  the  requirements  of  the  American  Society  of  Mechanical  Engineers  (ASME)  Boiler 
and  Pressure  Vessel  Code,  Section  XL  The  ASME  code  has  the  force  of  law  and  applies 
to  all  safety  related  pumps  and  valves  which  are  required  to  perform  a  specific  function  in 
the  safe  shutdown  of  a  reactor,  maintaining  the  shutdown  condition,  or  mitigating  the 
consequences  of  an  accident.  Testing  is  performed  to  assess  the  operational  readiness  of 
components,  and  thus  applies  mainly  to  standby  components.  The  ASME  code  generally 
requires  the  quarterly  testing  of  pumps  and  valves,  although  testing  during  cold  shutdown 
(Mode  5)  outages  is  allowed  if  it  is  impractical  to  test  quarterly  during  operation.  Cold 
shutdown  testing  has  no  specified  time  interval  for  performance.  If  a  cold  shutdown 
condition  never  occurs  during  the  course  of  an  operating  cycle,  then  cold  shutdown  testing 
shall  be  completed  during  the  refueling  outage.  This  means,  that  for  top  performing 
plants,  the  majority  of  cold  shutdown  testing  is  typically  performed  during  refueling 
outages.  Each  utility  must  maintain  a  record  showing  the  rationale  for  deferring  testing  to 
cold  shutdown  intervals.  NRC  approval  is  not  required  to  classify  a  test  as  a  cold 
shutdown  test,  although  the  records  justifying  the  extension  to  cold  shutdown  are 
auditable.  The  ASME  code  also  allows  tests  to  be  deferred  to  refueling  outages  if  cold 
shutdown  testing  or  quarterly  testing  is  impractical.  The  length  in  months  between 
refueling  outages  is  defined  in  the  plant  technical  specifications.  These  deferrals  require 
prior  NRC  approval  and  are  generally  associated  with  testing  involving  safety  systems  that 
cannot  practically  be  tested  with  the  core  or  vessel  head  in  place. 

As  shown  in  table  3.1  there  are  169  surveillances  associated  with  in-service  testing 
that  are  currently  performed  when  shutdown.  These  surveillances  should  be  resolved  to 
Categories  A,  B,  and  C  as  discussed  in  the  following  sections. 
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3. 1.1, 2  Category  A  Surveillances 


3.1. 1.2.1  Valve  Operability  Checks 

There  are  seven  surveillance  valve  stroke  checks  currently  performed  off-line 
which  should  be  considered  for  on-line  performance.  These  include  stroke  checks  of 
valves  in  the  Chemical  Volume  and  Control  (CS)  system.  Main  Steam  (MS)  system, 
Service  Water  (SW)  system,  and  the  Power  Operated  Relief  Valve  (PORV)  block  valves. 
Stroke  checks  are  performed  to  ensure  that  valves  reposition  within  specified  time  limits 
based  on  design  basis  analysis  and  to  trend  their  performance  from  check  to  check. 

Systems  with  redundant  trains  such  as  SW,  or  valves  whose  stroking  will  not  affect  system 
performance,  such  as  PORV  blocking  valves,  will  not  impact  plant  operations  or  safety 
and  thus  should  be  performed  on-line.  The  stroke  checks  and  timing  of  the  Main  Steam 
Isolation  Valves  (MSIV’s)  will  require  the  most  coordination  and  advance  planning  to 
perform.  To  perform  a  full  stroke  check  of  each  MSIV,  electrical  load  provided  to  the 
grid  and  reactor  power  will  have  to  be  reduced  to  less  than  75%  to  ensure  that  each  valve 
can  be  safely  stroked  without  exceeding  core  power  limits.  Although  there  is  little 
incentive  to  perform  MSIV  stroke  checks  on-line  on  an  18  month  cycle,  several  PWR’s 
with  operating  cycles  of  24  months  have  chosen  to  stroke  their  MSIV’s  with  the  reactor 
on-line,  performing  the  procedure  during  fall  or  spring  in  off  peak  evening  periods  when 
power  requirements  are  lowest.  Hence,  based  on  industry  precedent,  on-line  stroking  of 
the  MSIV’s  can  be  safely  performed. 


3. 1.1. 2.2  Remote  Valve  Position  Indication 

There  are  1 8  remote  valve  position  indication  surveillances  currently  performed 
off-line  which  can  be  performed  with  the  plant  on-line.  Remote  valve  position  indication 
checks  are  performed  to  ensure  that  the  remote  position  indications  of  valves  in  both  the 
open  and  closed  positions  match  the  actual  local  position  of  the  valves.  The  position 
indication  lights  are  also  often  used  as  a  reference  when  checking  the  stroke  times  of 
valves.  Typically,  remote  valve  position  indication  checks  are  done  concurrently  with 


61 


stroke  checks  of  the  valve.  The  remote  valve  position  indication  checks  which  can  be 
placed  in  Category  A  all  involve  systems  where  the  valves  are  currently  stroked  quarterly 
on-line  to  meet  1ST  stroke  check  requirements.  All  the  valves  are  accessible  at  power  and 
thus  the  valve  position  indication  can  be  checked  at  any  time  as  part  of  the  quarterly 
stroke  checks. 


3.1.1.2.3  Relief  Valves 

There  are  20  relief  valve  surveillances  covering  33  individual  relief  valves  currently 
tested  off-line  which  can  be  tested  with  the  plant  at  power.  These  relief  valves  are  located 
in  the  diesel,  safety  injection,  core  building  spray,  residual  heat  removal,  demineralized 
water,  and  waste  liquid  drain  systems.  Relief  valve  testing  is  performed  in  accordance 
with  the  “Operations  and  Maintenance  of  Nuclear  Power  Plants,  ASME/ANSI  (American 
National  Standards  Institute),  OM-1987”  Chapter  1.  Utilities  have  the  option  of  testing 
the  relief  in-place  or  bench  testing  a  spare  relief  valve  in  order  to  confirm  its  operability 
and  then  performing  a  simple  one  for  one  swap  of  the  relief  in  question.  With  the 
exception  of  Main  Steam  Safety  Valves,  most  utilities  opt  to  perform  swaps  with  bench 
tested  spares  because  it  places  the  individual  system  out  of  service  for  shorter  periods  of 
time  and  guarantees  that  the  replacement  relief  has  already  passed  its  lift  test.  Because  a 
system  is  inoperable  while  performing  relief  valve  swaps,  on-line  swaps  cannot  be 
performed  on  systems  which  are  required  to  be  active  with  the  reactor  on-line  such  as 
reactor  coolant  (RC)  or  component  cooling  (CC).  Passive  systems,  however,  such  as 
relief  valves  for  the  diesel  generators  can  be  replaced  by  tagging  the  component  out  of 
service  to  ensure  inoperability  during  relief  swaps.  Relief  valve  swaps  take  a  minimum 
amount  of  time  and  should  be  able  to  be  performed  well  within  the  system  LCO  time  limits 
with  proper  advance  planning.  The  minimum  technical  specification  LCO  time  for  the 
systems  listed  above  is  72  hours  for  containment  building  spray.  Even  assuming  that  a 
utility  will  not  voluntarily  exceed  50%  of  a  technical  specification  LCO,  that  leaves  36 
hours  in  which  to  perform  a  relief  valve  swap.  This  policy  is  reasonable  and  should  be 
pursued. 
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3.1, 1.2.4  Functional  Testing 

There  are  4 1  functional  tests  currently  performed  off-line  which  can  be  performed 
with  the  reactor  on-line.  System  functional  tests  are  detailed  inspections  of  each  system 
required  by  the  ASME  code  to  check  the  integrity  of  welds,  piping,  and  valves  System 
engineers  at  the  candidate  PWR  estimate  that  80-90%  of  each  system  is  already  checked 
with  the  reactor  on-line  and  that  the  remaining  10-20%  of  the  inspections  could  be 
performed  with  the  reactor  on-line  with  proper  planning.  For  those  portions  of  the 
systems  which  are  inaccessible  with  the  reactor  on-line,  enough  inspection  points  should 
exist  from  accessible  portions  of  the  system  to  make  a  sound  technical  decision  as  to 
whether  those  small  portions  which  are  inaccessible  could  safely  be  done  at  48  month 
intervals.  If  there  are  specific  concerns  about  waiting  that  long  between  inspections, 
remote  cameras  or  robotic  inspection  tools  could  provide  the  needed  information. 


3.1. 1.2.5  Pump  Operability  Checks 

The  turbine  driven  emergency  feedwater  (EFW)  pump  operability  checks  currently 
performed  off-line  can  be  performed  with  the  plant  on-line.  Pump  operability  checks  are 
performed  to  check  that  pump  parameters  including  pump  head,  inlet  pressure,  differential 
pressure,  and  vibration  are  within  specification.  While  the  turbine  driven  EFW  pump 
cannot  be  aligned  to  the  steam  generators  with  the  plant  on-line  because  its  source  of 
suction  water  is  too  cold  and  could  cause  thermal  shock  to  the  steam  generators,  the 
turbine  driven  EFW  pump  can  be  aligned  in  the  recirculation  mode  to  the  Refueling  Water 
Storage  Tank  (RWST)  to  confirm  the  necessary  pump  data. 


3.1. 1.3  Category  B  Surveillances 
3.1. 1.3.1  Valve  Operability  Checks 

There  are  17  valve  stroke  check  surveillances  which  include  over  60  individual  air 
operated  and  motor  operated  valves  currently  performed  while  shutdown  which  could 
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safely  be  performed  at  48  month  intervals.  These  valves  are  currently  stroked  at  36  month 
intervals.  Based  on  a  station  evaluation  of  motor  operated  valves  in  response  to  Generic 
Letter  89-10  (Safety-Related  Motor-Operated  Valve  Testing  and  Surveillance),  only  seven 
of  122  motor  operated  valves  were  recommended  for  testing  intervals  (36  months)  less 
than  48  months.  The  remaining  valves  had  recommended  maintenance  intervals  of  72 
months  or  more  and  are  therefore  compatible  with  an  extended  fuel  cycle.  The  evaluation 
combined  the  risk  significance  of  the  valve,  differential  pressure  conditions  across  the 
valve  during  demand,  and  whether  the  valve  was  required  to  reposition  in  case  of  a  design 
basis  accident.  Based  on  this  review,  only  those  valves  which  combined  a  high  risk  level 
with  a  high  differential  pressure  across  the  valve  were  recommended  for  maintenance 
intervals  less  than  48  months*.  High  differential  pressure  valves  have  a  significantly  higher 
failure  rate  than  valves  with  low  differential  pressures.  The  failure  mechanism  of  concern 
over  extended  intervals  is  binding  of  the  valve  caused  by  corrosion/wear  product  buildup 
or  lubrication  breakdovra.  The  lubrication  can  be  inspected  and  replenished  at  fi'equent 
intervals.  Additionally,  most  of  the  valves  in  this  group  are  large  butterfly  or  gate  valves 
which  exhibit  minimal  throttling  characteristics  over  the  first  half  of  valve  disc  travel.  This 
valve  characteristic  allows  the  partial  throttling  of  these  valves  without  interruption  of 
flow  to  the  system.  Partial  valve  strokes  at  more  frequent  intervals  should  eliminate  any 
valve  binding  concerns.  Additionally,  if  the  motor  is  sized  correctly  for  the  valve, 
overtorquing  of  the  valve  or  lack  of  power  from  the  motor  to  move  the  valve  to  its 
demand  position  should  not  be  a  concern.  Utilities  which  do  not  partially  cycle  their 
motor  operated  and  air  operated  valves  to  eliminate  valve  binding  should  consider  adding 
that  maintenance  practice  as  part  of  any  long-term  surveillance  strategy. 

3.1.1.3.2  Check  Valves 

There  are  28  check  valve  surveillances  which  include  a  total  of  106  check  valves 
currently  performed  shutdown  which  could  safely  be  performed  at  48  month  intervals. 


*  O’Regan,  Pat  J.,  Engineering  Evaluation  93-44.  “Evaluation  of  the  Candidate  PWR  Response  to 
Generic  Letter  89-10  (Safety-Related  Motor-Operated  Valve  Testing  and  Surveillance)”,  September  1993, 
P-4. 
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Check  valve  surveillances  are  intended  to  confirm  check  valve  operability  through  either 
visual  inspection,  radiographic  examination,  full  flow  checks  through  the  valve,  or  checks 
of  back  seat  tightness.  Check  valves  are  relatively  simple  in  design,  with  no  power 
requirements  and  very  few  moving  parts.  As  long  as  the  pins  holding  the  valve  disc  in 
place  do  not  bind  as  the  result  of  corrosion  products  or  other  foreign  material  buildup  the 
valve  is  likely  to  perform  its  intended  function.  A  review  of  plant  material  history  shows 
that  the  check  valves  are  very  reliable.  System  engineers  believe  that  these  106  check 
valves  would  easily  support  a  48  month  inspection  interv'al.  Similar  to  the  issues 
surrounding  motor  operated  valves,  many  of  these  check  valves  can  be  partially  stroked 
using  alternate  flow  paths.  Although  this  will  not  provide  a  full  flow  check,  it  will  exercise 
the  check  valve  sufficiently  to  prevent  the  buildup  of  corrosion  products  on  the  valve 
swing  surfaces.  In  addition  to  the  check  valve  data  available  at  the  candidate  PWR,  Oak 
Ridge  National  Laboratories  has  been  maintaining  a  Nuclear  Industry  Check  Valve  (NIC) 
database  since  1991  which  could  also  be  used  to  support  interval  extension  justifications. 


3.1. 1.3.3  Remote  Valve  Position  Indication 

There  are  1 5  remote  valve  position  indication  surveillances,  including  over  60 
individual  valves,  that  are  currently  performed  with  the  plant  shutdown  which  can  safely 
be  performed  at  48  month  intervals.  The  ASME  code  requires  that  valve  position 
indication  checks  be  performed  every  two  years.  The  valve  position  indication  check 
confirms  that  the  indicated  position  matches  the  actual  valve  position  in  both  the  open  and 
closed  positions.  The  1 5  remote  valve  position  indication  surveillances  listed  in  this 
section  are  typically  performed  in  conjunction  with  the  stroking  of  the  motor  and  air 
operated  valves  discussed  in  section  3. 1.1. 3.1.  Since  analysis  as  shown  that  these  valves 
can  be  safely  stroked  every  48  months,  the  valve  position  indication  checks  should  also  be 
deferred  until  the  valve  stroking.  Partial  verification  that  the  valve  position  indication 
system  is  functioning  properly  can  be  obtained  by  checking  that  the  valve  position 
indication  continues  to  match  the  normal  position  of  the  valve  and  that  the  position 
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changes  to  mid-position  (no  open  or  closed  light)  during  the  recommended  frequent 
partial  valve  stroke  checks. 

3.1. 1.3.4  Leak  Checks 

There  are  four  reactor  coolant  leak  rate  tests  performed  as  part  of  the  in-service 
testing  program  which  can  safely  be  performed  at  48  month  intervals.  These  valves  are 
subject  to  the  same  10CFR50  Appendix  J  requirements  as  containment  isolation  valves. 
After  two  successive  leak  tests  their  performance  intervals  could  be  extended  to  up  to  10 
years. 


3.1. 1.3.5  Pump  Operability  Checks 

The  three  auxiliary  feedwater  pumps  have  pump  operability  checks  currently 
performed  shutdown  which  could  safely  be  performed  at  48  month  intervals.  These  three 
pumps,  the  turbine  driven  EFW,  electric  driven  EFW,  and  the  Startup  Feed  Pump  (SUFP), 
can  all  be  run  in  the  recirculation  mode  to  confirm  that  most  of  their  key  operating 
parameters  are  within  specification.  The  only  requirement  that  cannot  be  fulfilled  on-line 
is  proving  that  each  pump  can  provide  rated  capacity  to  the  steam  generators.  The  SUFP 
is  only  operated  to  provide  water  to  steam  generators  in  hot  standby,  wet  lay-up,  or  with 
reactor  power  less  than  three  percent.  All  major  pump  parameters  can  be  confirmed  to  be 
within  specification  with  the  exception  of  sending  water  directly  to  the  steam  generators. 
The  EFW  pumps  are  used  as  backups  to  the  Main  Feed  Pumps  following  a  scram  in  order 
to  ensure  that  the  steam  generators,  which  are  the  primary  decay  heat  removal  source, 
continue  to  receive  water.  Because  the  suction  water  source  for  the  EFW  pumps  is  too 
cold  to  align  to  the  steam  generators  with  the  plant  on  the  line  due  to  thermal  shock 
concerns,  the  EFW  pumps  should  be  confirmed  operable  by  combining  past  performance 
history  with  pump  data  available  from  running  the  pumps  in  the  recirculation  mode  or 
against  shutoff  head  with  the  discharge  valves  shut.  This  should  provide  enough  data  to 
justify  deferring  aligning  the  EFW  pumps  to  the  steam  generators  for  capacity  checks  to 
once  every  48  months. 
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3.1. 1.4  Category  C  Surveillances 

Chapter  4  provides  a  more  detailed  discussion  of  each  of  the  Category  C 
surveillances  listed  in  sections  3 , 1 . 1 .4, 1  through  3.1.1 .4.3 . 

3.1. 1.4.1  Relief  Valves 

There  are  12  relief  valve  surveillances,  which  include  a  total  of  38  individual  relief 
valves,  currently  performed  shutdown  at  intervals  less  than  48  which  cannot  be  performed 
on  line,  and  are  unlikely  to  be  extendible  to  48  months.  These  38  valves  include  the  three 
pressurizer  relief  valves  which  are  Class  1  relief  valves  (primary  pressure  boundary)  and 
35  Class  2  relief  valves  (containment  pressure  boundary). 


3.1. 1.4.2  Diesel  Generator  Operability  and  Engineered  Safeguards  Pump  and  Valve 
Response  Time  Testing 

There  are  two  integrated  diesel  generator  operability  and  engineered  safeguards 
pump  and  valve  response  time  tests  (one  for  each  train)  currently  performed  shutdown  at 
18  month  intervals  which  cannot  be  performed  on  line,  and  are  unlikely  to  be  extendible  to 
48  months. 


3.1. 1.4.3  Valve  Operability  Checks 

There  is  one  valve  stroke  and  time  check  surveillance  currently  performed  with  the 
plant  shutdown  at  18  month  intervals  which  cannot  be  performed  on  line,  and  is  unlikely 
to  be  extendible  to  48  months.  This  surveillance  involves  the  stroke  check  of  three  motor 
operated  valves  evaluated  as  combining  the  highest  risk  level  and  the  highest  valve 
differential  pressure  during  operation.  These  valves  are  currently  recommended  for 
performance  checks  every  36  months  and  further  study  is  required  to  justify  their 
extension  to  48  months. 
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3.1. 1.5  Summary  of  In-Service  Testing  Surveillances 

Table  3.2  compares  the  current  18  month  surveillance  program  for  in-service 
testing  to  the  recommended  surveillance  program  for  a  48  month  fuel  cycle  based  on  the 
justifications  provided  above. 

In-Service  Testing  Surveillance  Summary 


Table  3  -  2 


Cycle  Length 

Category  A 

Category  B 

Category  C 

1 8  Months 

60 

169 

— — 

48  Months 

147 

67 

15 

3.1.2  Reactivity  Control 

3. 1.2.1  Category  A  Surveillances 

There  is  one  reactivity  control  surveillance  currently  performed  off-line  which 
should  be  considered  for  on-line  performance.  The  emergency  boration  flow  test  is 
performed  to  ensure  that  the  two  boric  acid  pumps  supply  a  minimum  of  30  gpm  to  the 
reactor  coolant  system  via  the  suction  of  the  coolant  charging  pumps.  The  test  is  currently 
performed  off-line  because  planners  do  not  want  boric  acid  injected  into  the  reactor 
coolant  system  with  the  reactor  on  the  line.  However,  this  assumes  that  the  boric  acid 
pumps  must  take  a  suction  on  the  boric  acid  tanks  to  achieve  their  30  gpm  check. 
Inspection  of  the  system  reveals  that  the  boric  acid  pumps  can  also  be  aligned  to  take  a 
suction  from  a  1620  gallon  boric  acid  batch  add  tank.  The  batch  add  tank  serves  as  a 
mixing  point  for  boric  acid  and  uses  the  same  boric  acid  pumps  to  fill  the  boric  acid  tanks 
to  normal  levels.  For  the  purposes  of  this  test,  the  batch  add  tank  could  be  filled  with 
demineralized  water  and  the  boric  acid  pumps  aligned  to  take  a  suction  from  the  batch  add 
tank  for  the  flow  check.  This  has  the  added  advantage  of  keeping  the  normal  boric  acid 
tanks  filled  during  testing  in  case  they  are  needed  for  an  actual  emergency.  In  the  unlikely 
event  that  they  were  needed  to  inject  boric  acid  into  the  reactor  coolant  system,  it  would 
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be  a  simple  matter  of  repositioning  two  valves  to  realign  the  suction  of  the  boric  acid 
pump  back  to  its  associated  boric  acid  tank.  The  redundancy  of  the  system  (there  are  two 
boric  acid  pumps  and  boric  acid  tanks)  also  means  that  during  the  surveillance  at  least  half 
the  system  would  be  available  to  fulfill  its  normal  function. 


3.L2.2  Category  B  Surveillances 

Four  surveillances  currently  performed  shutdown  can  safely  be  performed  at  48 
month  intervals.  One  of  the  surveillances  is  performed  weekly  as  part  of  the  normal 
refueling  outage  surveillance  package  and  is  independent  of  cycle  length. 

Control  and  shutdown  rod  drop  testing  is  currently  done  at  18  month  intervals 
following  refueling  to  guarantee  that  the  control  rods  have  an  unimpeded  path  to  the 
bottom  of  the  core  and  that  maximum  drop  times  are  consistent  with  the  assumed  drop 
times  used  in  the  plant  safety  analysis.  While  the  current  plant  technical  specifications  call 
for  performance  of  rod  drop  testing  every  18  months  following  refueling,  the  NRC’s 
recent  Improved  Standard  Technical  Specifications  (ISTS)  only  require  rod  drop  testing 
following  vessel  head  removal  which  is  a  subtle  but  significant  change  in  wording.  Since 
the  vessel  head  will  not  be  removed  between  refueling  periods,  rod  drop  testing  can  safely 
be  performed  at  48  month  intervals.  Core  designers  should  continue  to  evaluate  the 
possibility  of  fuel  swelling  over  a  48  month  cycle  to  ensure  that  rod  channel  clearances 
would  not  inhibit  rod  motion  and  cause  rod  drop  times  to  exceed  design  basis  limits. 

Rod  position  indication  checks  are  required  every  18  months.  The  purpose  of  the 
rod  position  checks  is  to  confirm  that  the  highly  accurate  (+/-  1  step  or  +/-5/8  inch) 
demand  position  for  each  rod,  generated  based  on  the  amount  of  time  a  rod  is  withdrawn 
or  inserted,  matches,  within  specified  limits,  the  indicated  rod  position  generated  by  a 
series  of  coils  spaced  along  each  hollow  rod  tube  which  produce  an  inductive  analog 
signal.  The  demand  position,  although  theoretically  more  accurate,  will  not  identify  if  a 
rod  is  stuck  in  the  channel  during  insertion  or  withdrawal.  The  purpose  of  the  rod 
position  check  is  to  ensure  that  the  two  indication  systems  match  over  the  entire  range  of 
rod  motion  to  ensure  that  a  stuck  rod  would  be  identified.  Once  a  plant  is  at  power,  the 
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control  rods  are  fully  withdrawn  and  remain  fully  withdrawn  with  the  long  term  reactivity 
balance  maintained  by  changing  core  boron  level.  As  long  as  the  rods  are  maintained  fully 
withdrawn  the  relationship  between  the  demand  position  and  the  indicated  position 
remains  unchanged  regardless  of  the  cycle  length.  If  however,  the  reactor  had  to  be 
shutdown  after  more  than  1 8  months  since  the  performance  of  the  last  rod  position 
checks,  then  these  checks  would  have  to  be  performed  prior  to  reactor  startup.  In 
essence,  the  scheduling  of  rod  position  checks  could  conform  to  a  48  month  cycle. 
However,  the  rod  position  checks  would  be  required  to  be  on  a  hot  list  for  completion. 


3.1.2.3  Category  C  Surveillances 

There  are  no  category  C  surveillances  for  this  technical  specification. 

3.1.2.4  Summary  of  Reactivity  Control  Surveillances 

Table  3.3  compares  the  current  18  month  surveillance  program  for  reactivity 
control  surveillances  to  the  recommended  surveillance  program  for  a  48  month  fuel  cycle 
based  on  the  justifications  provided  above. 

Reactivity  Control  Surveillance  Summary 


Table  3  -  3 


Cycle  Lengtb 

Category  A 

Category  B 

Category  C 

18  Months 

12 

5 

— — 

48  Months 

13 

4 

0 

3.1.3  Power  Distribution  Limits 
3.1.3.1  Category  A  Surveillances 

The  reactor  coolant  system  flow  measurement  surveillance  currently  performed 
during  refueling  outages  can  be  performed  with  the  reactor  on-line.  The  measurement  is 
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performed  via  a  precision  heat  balance.  The  procedure  for  completion  of  the  surveillance 
has  no  mode  requirements  for  performance. 


3.1.3.2  Category  B  Surveillances 

There  are  not  category  B  surveillances  for  this  technical  specification. 


3.1.3.3  Category  C  Surveillances 

There  are  no  category  C  surveillances  for  this  technical  specification. 


3.1.3.4  Summary  of  Power  Distribution  Surveillances 

Table  3  .4  compares  the  current  18  month  surveillance  program  for  power 
distribution  surveillances  to  the  recommended  surveillance  program  for  a  48  month  fuel 
cycle  based  on  the  justifications  provided  above. 

Power  Distribution  Surveillance  Summary 

Table  3  -  4 


Cycle  Length 

Category  B 

Category  C 

1 8  Months 

16 

1 

48  Months 

17 

0 

0 

3.1.4  Instrumentation 

3.1. 4.1  Category  A  Surveillances 

There  are  72  instrumentation  surveillances  currently  performed  while  shutdown 
which  should  be  considered  for  on-line  performance.  Thirty-six  of  these  surveillances 
involve  instrument  calibration  checks  and  36  involve  time  response  testing. 
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The  instrument  calibrations  include  the  following  instruments: 

Reactor  Trip  System  Instrumentation 

Loop  Flow  -  12  surveillances 

Pressurizer  Level  -  3  surveillances 

Power  Range  Nuclear  Instrument  (PRNI)  -  4  surveillances 

Pressurizer  Pressure  -  4  surveillances 

Temperature  detectors  -  2  surveillances 

Turbine  Impulse  Pressure  Calibration  -  2  surveillances 

Turbine  Stop  Valve  Pressure  Switch  Calibration  -  2  surveillances 

Engineered  Safety  Feature  Actuation  System  (ESFAS)  Instrumentation 

Containment  Pressure  -  3  surveillances 

Post  Accident  Monitoring  (PAM)  Instrumentation 

Excore  flux  monitors  -  2  surveillances 

Reactor  Vessel  Level  Instrumentation  -  2  surveillances 

All  the  instruments  listed  above  are  accessible  with  the  reactor  on-line. 

Additionally,  for  Reactor  Trip  System  instruments  and  ESFAS  instruments  the  ISTS  allow 
a  channel  to  be  bypassed  for  up  to  four  hours  for  surveillance  testing.  System  engineers 
confirm  that  instrument  calibrations  can  easily  be  performed  in  this  time  frame.  One 
channel  of  PAM  instrumentation  may  be  bypassed  for  up  to  30  days,  allowing  easy  on-line 
calibrations. 

In  the  past,  concerns  over  reactor  trips  caused  by  operator  error  or  other  spurious 
channel  trips  during  the  performance  of  instrument  calibrations  led  many  utilities  to  defer 
all  reactor  trip  system  instrument  calibrations  to  shutdown  periods.  A  relatively 
inexpensive,  but  key  addition,  to  the  Reactor  Trip  System  now  allows  on-line  performance 
of  calibrations  with  significantly  less  risk  of  shutdown  from  either  operator  error  or 
spurious  channel  trips.  The  original  design  of  many  Westinghouse  protective  systems 
called  for  a  reactor  trip  if  a  trip  signal  was  received  from  at  least  two  of  four  instrument 
channels  with  inputs  to  the  reactor  protective  system.  In  the  original  design,  an  instrument 
channel  was  placed  in  trip  to  perform  on-line  tests  or  calibrations.  This  meant  that  a  trip 
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signal  from  only  one  of  the  three  remaining  channels  was  sufficient  to  cause  a  reactor  trip. 
This  extra  trip  signal  could  originate  from  an  actual  signal,  spurious  signal,  or  by  operator 
error  if  a  wrong  switch  or  dial  were  adjusted  during  the  calibration  procedure.  This 
system  was  overly  conservative  and  did  not  allow  for  one  spurious  trip  signal  as  the 
system  was  originally  designed.  To  correct  this  problem,  the  design  was  changed  by 
installation  of  a  Bypass  Test  Instrument  (BTI).  With  the  BTI,  an  instrument  is  bypassed 
and  not  placed  in  trip  to  perform  testing  or  calibration.  While  in  bypass,  the  instrument 
provides  no  inputs  to  the  protective  system  which  is  now  configured  in  a  two  of  three 
logic  required  for  a  trip.  With  the  BTI  installed,  safe  on-line  testing  can  occur  with  a  very 
high  degree  of  confidence. 

The  36  time  response  surveillances  are  performed  to  ensure  that  the  time  interval 
from  a  given  limiting  plant  condition  until  the  loop  produces  a  corresponding  instrument 
signal  to  the  protective  system  is  within  specification.  These  tests  are  performed  at  54  to 
72  month  intervals  depending  on  the  instrument  and  can  safely  be  performed  on-line 
because  of  the  redundancy  and  coincidence  requirements  for  each  instrument.  Their 
current  performance  interval  does  not  preclude  a  48  month  fuel  cycle,  but  they  should  be 
considered  for  on-line  performance. 


3. 1.4.2  Category  B  Surveillances 

There  are  42  instrumentation  surveillances  currently  performed  shutdown  which 
can  safely  be  performed  at  48  month  intervals. 

Twenty  four  of  the  surveillances  are  inspections  of  main  turbine  valves  including 
high  pressure  turbine  stop  valves,  high  pressure  turbine  control  valves,  and  low  pressure 
turbine  control  valves.  These  valves  are  currently  disassembled,  inspected,  and 
reassembled  at  approximately  40  month  intervals.  Material  history  records  indicate  that 
the  valves  inspections  could  be  performed  at  48  months  intervals. 

There  are  12  calibrations  of  RCP  and  4. 16  KV  breaker  undervoltage  and 
underfrequency  relays.  The  calibrations  involve  the  testing  of  two  sets  of  two  relays 
which  are  responsible  for  initiating  undervoltage  or  underfrequency  trip  signals  to  the 
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Solid  State  Protection  System  (SSPS).  The  signals  warn  of  an  impending  loss  of  flow  so 
that  the  SSPS  can  trip  the  reactor  on  an  anticipatory  loss  of  flow  and  prevent  a  possible 
sequential  loss  of  flow.  Both  sets  of  relays  must  send  a  signal  to  the  SSPS  to  initiate  a  trip 
signal.  One  of  the  relays  can  be  bypassed  similar  to  the  BTI  system  described  in  section 
3. 1 .4. 1  and  tested  on-line  quarterly.  The  other  relay,  an  Agastat  time  delay  relay,  cannot 
be  tested  on-line  because  its  time  delay  design  cannot  be  bypassed.  Testing  therefore 
inserts  one  of  the  two  trip  signals  necessary  to  initiate  a  reactor  trip,  leaving  the  plant  in  an 
undesirable  one  of  one  logic  required  for  a  reactor  trip.  System  engineers  state,  and 
material  records  confirm,  that  the  failure  rates  of  both  these  types  of  relays  is  so  small  that 
their  tests  are  extendible  to  48  month  intervals.  As  a  second  option,  redesign  of  the 
Agastat  relay  device  to  allow  on-line  bypass  testing  would  permit  these  12  calibration 
surveillances  to  be  performed  on-line. 

Reactor  Trip  System  switchgear  inspections  and  post  refueling  pre  startup  Reactor 
Trip  Breaker  surveillances  can  safely  be  performed  at  48  month  intervals. 

Solid  State  Protective  System  (SSPS)  time  response  testing  is  currently  performed 
shutdown  at  36  month  intervals.  The  highly  reliable  components  of  this  system  can  safely 
be  tested  at  48  month  intervals. 

The  two  Source  Range  Nuclear  Instrument  (SRNI)  calibrations  can  only  be 
performed  while  shutdown.  Since  they  provide  an  important  safety  monitoring  function 
during  reactor  startups  they  should  continue  to  be  calibrated  at  18  month  intervals  prior  to 
a  reactor  startup.  However,  once  reactor  power  is  raised  into  the  intermediate  range  the 
SRNI’s  are  turned  off  to  prevent  detector  damage  and  thus  have  no  function  when  the 
reactor  is  at  power.  SRNI  calibrations  can  therefore  be  deferred  past  18  months  as  long 
as  the  reactor  stays  at  power.  After  18  months  the  SRNI’s  should  be  placed  on  a  hot  list 
for  calibration  if  the  reactor  is  shutdown  before  a  scheduled  refueling  outage.  Calibration 
should  occur  before  reactor  startup  is  begun. 
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3.1. 4.3  Category  C  Surveillances 

There  are  two  surveillances  currently  performed  while  shutdown  at  1 8  month 
intervals  which  cannot  be  performed  on  line,  and  which  are  unlikely  to  be  extendible  to  48 
months.  The  two  surveillances  are  identical  (one  for  each  train)  and  verify  that  the 
automatic  safety  injection,  containment  building  spray,  and  containment  building  air 
systems  actuate  within  allowable  time  limits  upon  receipt  of  a  test  signal.  The  tests  also 
verify  that  manual  alarms  for  these  systems  function  correctly.  These  tests  are  typically 
performed  in  conjunction  with  the  Diesel  Generator  Operability  and  Engineered 
Safeguards  Pump  and  Valve  Response  Time  Testing  described  in  section  3.1.1 .4.2. 
Chapter  4  provides  a  more  detailed  discussion  of  this  Category  C  surveillance. 


3.1. 4.4  Summary  of  Instrumentation  Surveillances 

Table  3.5  compares  the  current  18  month  surveillance  program  for  instrumentation 
surveillances  to  the  recommended  surveillance  program  for  a  48  month  fuel  cycle  based  on 
the  justifications  provided  above. 

Instrumentation  Surveillance  Summary 


Table  3  -  5 


Cycle  Length 

Category  A 

Category  B 

Category  C 

1 8  Months 

318 

118 

48  Months 

390 

44 

2 
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3.1.5  Reactor  Coolant  System 


3.1. 5.1  Category  A  Surveillances 

There  are  five  surveillances  currently  performed  shutdown  which  should  be 
considered  for  on-line  performance.  These  include  two  incore  instrument  sump  level 
calibrations,  pressurizer  heater  kilowatt  check,  pressurizer  pressure  control  loop 
calibration,  and  pressurizer  relief  tank  temperature  calibration.  All  the  instruments  are 
accessible  during  reactor  operation  and  there  are  no  mode  restrictions  in  the  procedures 
for  performing  the  surveillances. 


3.1. 5.2  Category  B  Surveillances 

There  are  four  surveillances  currently  performed  shutdown  which  can  safely  be 
performed  at  48  month  intervals.  Two  of  the  surveillances  are  performed  to  meet 
requirements  when  in  a  refueling  outage  and  are  therefore  independent  of  cycle  length. 

The  reactor  coolant  pump  flywheel  bore  and  keyway  are  currently  ultrasonically 
inspected  for  volumetric  expansion  in  the  areas  of  highest  stress  concentration  every  36 
months.  Material  history  records  indicate  and  discussions  with  system  engineers  and 
pump  vendors  confirm  that  this  test  could  safely  be  performed  at  48  month  intervals.  A 
complete  surface  examination  of  all  exposed  reactor  coolant  pump  surfaces  and  a 
complete  ultrasonic  volumetric  examination  is  conducted  at  approximately  10  year 
intervals  and  does  not  impact  on  a  48  month  operating  cycle. 


3.1. 5.3  Category  C  Surveillances 

Steam  generator  eddy  current  testing  is  currently  performed  shutdown  at  18-24 
month  intervals.  This  surveillance  cannot  be  performed  on  line,  and  is  unlikely  to  be 
extendible  to  48  months.  Chapter  4  provides  a  more  detailed  discussion  of  this  Category 
C  surveillance. 


76 


3.1. 5.4  Summary  of  Reactor  Coolant  System  Surveillances 

Table  3.6  compares  the  current  18  month  surveillance  program  for  reactor  coolant 
system  surveillances  to  the  recommended  surveillance  program  for  a  48  month  fuel  cycle 
based  on  the  justifications  provided  above. 

Reactor  Coolant  System  Surveillance  Summary 


Table  3  -  6 


Cycle  Length 

Category  A 

Category  B 

Category  C 

1 8  Months 

8 

10 

48  Months 

13 

4 

1 

3.1.6  Emergency  Core  Cooling  Systems 
3.1.6. 1  Category  A  Surveillances 

There  are  three  surveillances  currently  performed  off-line  which  should  be 
considered  for  on-line  performance. 

The  Safety  Injection  (SI)  accumulator  outlet  valve  P-11  surveillance  demonstrates 
the  ability  of  the  four  SI  accumulator  outlet  valves  to  open  automatically  when  the  reactor 
coolant  pressure  exceeds  the  P-1 1  setpoint.  The  P-1 1  setpoint  is  a  combination  of  plant 
signals  whose  simultaneous  occurrence  is  considered  to  be  indication  of  a  large  loss  of 
coolant  accident.  The  four  motor  operated  valves  associated  with  this  test  have  a  low  risk 
significance  and  a  low  differential  pressure  across  the  valve  during  design  operation. 

Based  on  this,  they  are  recommended  for  testing  at  intervals  greater  than  every  10-15 
years^.  Although  valve  operation  cannot  occur  with  the  plant  on-line,  the  P-11  setpoint 
can  still  be  tested  by  opening  the  four  breakers  feeding  these  motor  operated  valves  and 
installing  test  gear  to  show  that  a  valve  reposition  signal  reaches  each  SI  accumulator 


®  O’Regan,  Table  3. 
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valve  upon  insertion  of  a  simulated  P-1 1  setpoint.  The  test  could  easily  be  conducted 
within  an  approved  LCO. 

The  RHR/RC  suction  valve  interlock  verification  surveillance  is  performed  to 
ensure  that  the  two  RHR  pump  double  suction  valves  which  isolate  the  high  pressure 
reactor  coolant  system  hot  leg  from  the  low  pressure  RHR  piping  will  not  open  if  the 
reactor  coolant  pressure  is  365  psig  or  greater.  The  purpose  of  the  interlock  is  to  prevent 
damage  to  the  RHR  piping  and  a  possible  LOCA.  The  RHR  is  a  low  pressure  decay  heat 
removal  system  principally  designed  for  use  when  shutdown.  Removal  of  one  train  at  a 
time  from  service  for  testing  with  the  reactor  on-line  involves  lower  risk  than  if  the  test 
was  performed  while  shutdown.  To  ensure  that  high  pressure  water  is  not  inadvertently 
injected  into  the  low  pressure  RHR  suction  piping  should  the  test  fail,  the  breakers  to  the 
RHR  suction  valves  motor  operators  should  be  opened  and  test  gear  installed  to  confirm 
that  the  interlock  functions  properly  when  attempts  are  made  to  open  the  valve  remotely 
with  the  reactor  coolant  system  pressure  greater  than  365  psig. 

The  containment  and  containment  spray  recirculation  sump  surveillance  has  no 
mode  restrictions  associated  with  its  performance  and  can  be  performed  with  the  plant  on¬ 
line.  The  sump  is  accessible  during  reactor  operations,  but  additional  radiological  controls 
might  be  required  to  safely  perform  the  surveillance. 


3.1.6.2  Category  B  Surveillances 

There  are  five  ECCS  surveillances  currently  performed  off-line  which  can  be 
performed  at  48  month  intervals.  Four  of  the  five  surveillances  are  performed  weekly  only 
when  shutdown  and  are  independent  of  cycle  length.  The  ECCS  throttle  valve  verification 
confirms  that  12  throttle  valves  in  the  SI  system  have  not  been  moved  from  their  preset 
positions.  These  valves  are  inaccessible  during  reactor  operation  and  thus  can  only  be 
inspected  or  operated  during  shutdown  periods.  The  surveillance  performance  interval  is 
therefore  independent  of  cycle  length. 
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3. 1.6.3  Category  C  Surveillances 

There  are  two  identical  surveillances,  one  for  each  ECCS  train,  currently 
performed  off-line  at  1 8  month  intervals  which  cannot  be  performed  on  line,  and  are 
unlikely  to  be  extendible  to  48  months.  This  test  which  is  similar  in  nature  to  the  ESFAS 
integrated  test  included  in  section  3. 1.4.3,  tests  that  various  ECCS  systems  will  realign 
within  specified  time  limits  upon  receipt  of  a  SI  signal.  This  includes  initiation  of 
feedwater  isolation,  diesel  generator  start,  containment  isolation,  containment  ventilation 
system  isolation,  and  primary  component  cooling  water  system  (PCC)  realignment. 
Chapter  4  provides  a  more  detailed  discussion  of  this  Category  C  surveillance. 


3.1. 6.4  Summary  of  ECCS  Surveillances 

Table  3.7  compares  the  current  18  month  surveillance  program  for  emergency  core 
cooling  system  surveillances  to  the  recommended  surveillance  program  for  a  48  month 
fuel  cycle  based  on  the  justifications  provided  above. 

ECCS  Surveillance  Summary 


Table  3  -  7 


Cycle  Length 

Category  A 

Category  B 

Category  C 

18  Months 

6 

10 

— 

48  Months 

9 

5 

2 

3.1.7  Containment  Systems 
3.1. 7.1  Discussion 

The  move  towards  a  performance  based  containment  leak  testing  program, 
approved  in  the  latest  changes  to  10CFR50  Appendix  J,  has  made  the  containment  testing 
program  compatible  with  a  48  month  fuel  cycle.  Integrated  Leak  Rate  Tests  (Type  A) 
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may  be  performed  at  up  to  10  year  intervals  based  on  past  performance  results. 

Penetration  Leak  Rate  Tests  (Type  B),  and  Valve  Seat  Leakage  Tests  (Type  C)  may  be 
performed  at  up  to  5  year  intervals  based  on  past  performance  results. 

Leak  rate  tests  are  required  to  be  performed  with  air  to  simulate  the  worst  case 
design  conditions  which  the  valves,  piping,  or  penetrations  would  be  subject  to  in  the 
event  of  a  release  of  radioactivity  to  the  containment.  For  this  reason,  it  is  very  difficult  to 
perform  leak  rate  tests  of  valves  in  fluid  systems  with  the  reactor  on-line  because  the 
system  must  be  drained  prior  to  leak  rate  testing.  Consequently,  most  of  the  fluid  system 
leak  rate  tests  are  performed  during  outages  when  the  operations  department  can  drain  the 
system  to  support  leak  rate  testing  and  other  required  maintenance. 


3.1.7.2  Category  A  Surveillances 

There  are  36  containment  surveillances  currently  performed  while  shutdown  which 
should  be  considered  for  on-line  performance.  All  the  surveillances  involve  gas  systems, 
systems  which  can  be  drained  on-line,  or  personnel  hatches  which  are  accessible  during 
plant  operation.  These  include  Waste  Liquid  Drains  (WLD),  Containment  Air  Handling 
(CAH),  Combustible  Gas  Control  (CGC),  Fire  Protection  (FP),  Nitrogen  Gas  (NG),  and 
Containment  Building  Spray  (CBS). 


3.1. 7.3  Category  B  Surveillances 

There  are  20  containment  surveillances  currently  performed  shutdown  at  1 8  month 
intervals  whose  performance  intervals  are  extendible  to  48  months.  These  20  surveillances 
include  the  Reactor  Containment  Integrated  Leak  Rate  Test  and  19  Type  C  leak  rate  tests 
performed  on  systems  including;  Reactor  Coolant  (RC),  Component  Cooling  (CC), 
Chemical  Volume  and  Control  (CS),  Safety  Injection  (SI),  Demineralized  Water  (DM), 
Reactor  Makeup  Water  (RMW),  and  Spent  Fuel  Handling  (SF).  Some  of  these  fluid 
systems  could  be  drained  to  conduct  air  drop  tests  with  the  reactor  on-line.  However, 
because  the  valve  performance  history  will  allow  the  performance  interval  to  be  extended 
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to  48  months,  the  added  work  required  to  perform  the  testing  on-line  makes  it  an 
uneconomical  choice. 


3.1. 7.4  Category  C  Surveillances 

There  are  no  Category  C  containment  surveillances. 


3.1. 7.5  Summary  of  Containment  Surveillances 

Table  3.8  compares  the  current  18  month  surveillance  program  for  containment 
surveillances  to  the  recommended  surveillance  program  for  a  48  month  fuel  cycle  based  on 
the  justifications  provided  above. 

Containment  Surveillance  Summary 


Table  3  -  8 


Cycle  Length 

Category  A 

Category  B 

Category  C 

1 8  Months 

25 

56 

— — 

48  Months 

61 

20 

0 

3.1.8  Plant  Systems 

3.1.8.1  Category  A  Surveillances 

All  10  of  the  plant  system  surveillances  currently  performed  off-line  should  be 
considered  for  on-line  performance. 

Eight  of  the  surveillances  involve  calibrations  of  the  two  emergency  feedwater 
flow  indication  and  auto  valve  closure  instruments  associated  with  each  of  the  four  steam 
generators.  The  flow  indicators  provide  a  signal  which  isolates  the  emergency  feedwater 
piping  in  the  event  of  a  feedwater  rupture.  During  instrument  calibration  this  signal  is 
unavailable,  However,  there  are  two  valves  and  two  instruments  on  each  loop  and  the 
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redundant  instrument  is  still  available  to  provide  an  isolation  signal  if  required.  Calibration 
of  the  instruments,  one  at  a  time  could  easily  be  accomplished  during  a  LCO. 

Both  the  turbine  driven  emergency  feedwater  (EFW)  pump  and  the  startup 
feedwater  pump  (SUFP)  can  be  tested  on-line.  The  surveillance  for  the  turbine  driven 
EFW  pump  involves  verifying  that  steam  isolation  valves  to  the  pump  turbine  reposition 
and  that  the  pump  starts  upon  a  loss  of  feedwater  flow  signal.  The  test  is  currently 
performed  during  cold  shutdown  because  of  a  desire  to  avoid  putting  cold  water  from  the 
turbine  EFW  pump  into  the  steam  generators  with  the  reactor  plant  hot.  However,  the 
purpose  of  this  surveillance  is  only  to  test  whether  the  pump  actually  starts  and  not 
whether  water  flows  to  the  steam  generators.  The  EFW  pump  capacity  checks  to  the 
steam  generator  are  performed  as  part  of  a  separate  in-service  testing  surveillance 
described  in  section  3  1.1.3.5.  Since  double  valve  isolation  is  available  between  the 
turbine  EFW  pump  and  the  steam  generator,  the  test  can  be  safely  conducted  during  an 
LCO. 

The  SUFP  surveillance  is  a  timed  test  to  ensure  that  operators  can  manually  switch 
the  SUFP  power  supply  to  an  emergency  source  and  manually  align  the  SUFP  to  the 
steam  generators  within  30  minutes.  The  surveillance  is  performed  to  show  that  operators 
can  avoid  steam  generator  dryout  conditions  in  the  event  the  motor  driven  EFW  pump  is 
lost  with  the  plant  shutdown  but  still  hot.  The  entire  surveillance  can  be  safely  performed 
on-line  during  an  LCO  while  maintaining  double  valve  protection  between  the  SUFP  and 
the  steam  generators. 


3.1.8.2  Category  B  Surveillances 

There  are  no  plant  system  surveillances  which  are  recommended  for  off-line 
performance  at  48  month  intervals. 


3.1.8.3  Category  C  Surveillances 

There  are  no  Category  C  plant  system  surveillances. 
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3.1. 8.4  Summary  of  Plant  Systems  Surveillances 

Table  3.9  compares  the  current  18  month  surveillance  program  for  plant  system 
surveillances  to  the  recommended  surveillance  program  for  a  48  month  fuel  cycle  based  on 
the  justifications  provided  above. 

Plant  Systems  Surveillance  Summary 


Table  3  -  9 


Cycle  Length 

Category  A 

Category  B 

Category  C 

18  Months 

41 

10 

— — 

48  Months 

51 

0 

0 

3.1.9  Electrical  Systems 
3.1.9.1  Discussion 

Electrical  system  surveillances  make  up  by  far  the  largest  portion  of  individual 
technical  specification  surveillances  (about  48%).  The  vast  majority  of  these  surveillances 
involve  breaker  inspections,  calibrations,  or  part  replacements  which  are  currently 
performed  shutdown  at  60  month  intervals.  With  the  current  fuel  cycle  of  18  months,  this 
means  that  approximately  1/3  of  the  shutdown  surveillances  are  performed  during  each 
outage  to  level  the  workload.  However,  if  the  fuel  cycle  was  extended  to  48  months, 
utilities  would  have  to  make  a  choice.  They  would  either  have  to  significantly  increase 
their  electrical  surveillance  workscope  during  outages  (a  threefold  increase)  or  perform 
more  of  the  surveillances  with  the  reactor  on-line.  System  engineers  confirmed  that  most 
of  the  60  month  surveillances  could  be  performed  on-line,  but  that  planning  and  execution 
of  the  surveillances  would  be  more  difficult.  Utilities  will  have  to  weigh  the  costs  of 
performing  the  majority  of  electrical  surveillances  on-line  versus  either  extending  outage 
lengths  or  incurring  extra  labor  costs  to  complete  all  the  electrical  surveillances  in  the 
current  outage  time  frame. 
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3.1. 9.1  Category  A  Surveillances 

There  are  792  electrical  surveillances  currently  performed  while  shutdown  which 
should  be  considered  for  on-line  performance.  Of  these  surveillances,  787  deal  directly 
with  breakers  including  penetration  protection  checks,  unitized  starter  checks,  molded 
case  circuit  breaker  inspections,  thermal  overload  relay  calibrations,  and  thermal  overload 
relay  replacements.  For  each  of  these  787  surveillances  the  breaker’s  fiinction  and  its 
electrical  accessibility  will  have  to  be  analyzed  to  determine  if  it  can  be  performed  on-line. 
Because  it  was  too  time  consuming  and  not  of  significant  generic  value,  each  of  the  787 
breaker  surveillances  were  not  checked  to  confirm  that  they  could  be  performed  on-line. 
Rather,  system  engineer  interviews  were  relied  upon  to  confirm  that  the  vast  majority  of 
these  breaker  surveillances  could  be  performed  on-line.  The  breaker  surveillances  which 
cannot  be  performed  on-line  have  performance  intervals  of  60  months  and  are  therefore 
already  compatible  with  performance  during  refueling  outages  at  48  months. 

Diesel  Generator  surveillances  including  periodic  inspections,  fuel  pump  flow 
checks,  and  24  hour  load  tests  can  be  performed  on-line  within  a  LCO.  The  technical 
specifications  allow  up  to  a  seven  day  LCO  with  one  diesel  removed  from  service.  Many 
utilities  have  gotten  NRC  permission  to  extend  the  length  of  this  LCO  to  14  days  by 
adding  an  additional  dedicated  emergency  power  source  such  as  a  mobile  diesel  generator 
or  a  hydro-electric  tie  line  during  periods  when  one  of  the  on-site  diesels  is  removed  from 
service  for  maintenance.  A  mobile  generator  would  be  cost  effective  if  used  by  a  utility 
which  owns  several  plants  in  close  proximity  to  each  other.  Use  of  the  mobile  generator 
to  support  site  diesel  generator  maintenance  could  be  coordinated  within  a  utility  to 
maximize  use  of  the  mobile  generator  and  prevent  having  to  purchase  one  generator  for 
each  plant  within  the  utility  chain. 

As  an  important  aside,  even  if  on-line  performance  for  diesel  inspections  is  chosen, 
it  is  my  opinion  that  an  18  month  open  and  inspect  interval  is  excessive  and  may  result  in 
more  problems  than  it  solves.  Diesel  generators  are  prime  candidates  for  performance 
based  maintenance  programs.  This  includes  the  use  of  advanced  on-line  monitoring 
techniques  such  as  lube  oil,  thermographic,  and  vibration  analysis.  Additionally,  detailed 
trend  analyses  data  are  available  following  quarterly  and  1 8  month  full  load  tests  which 
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should  be  used  to  confirm  proper  performance.  Serious  consideration  should  be  given  to 
extending  the  performance  interval  of  diesel  inspections  to  at  least  36  months  between 
each  open  and  inspect  surveillance. 


3.1. 9.2  Category  B  Surveillances 

There  are  22  electrical  surveillances  currently  performed  shutdown  which  can  be 
performed  at  48  month  intervals.  Five  of  these  surveillances  are  performed  solely  to  meet 
outage  requirements  and  are  independent  of  cycle  length.  Three  of  the  surveillances,  two 
Fuel  Oil  Service  Tank  cleanings,  and  a  Diesel  Generator  simultaneous  start  test,  have  10 
year  performance  intervals  and  can  be  scheduled  for  performance  every  other  outage. 

There  are  ten  breaker  overcurrent  relay  checks  including  the  four  RCP  breakers 
and  the  EFW  pump  breaker  which  can  be  performed  at  48  month  intervals.  Material 
history  records  and  system  engineer  consultation  confirm  that  these  relays  are  highly 
reliable  and  would  allow  testing  at  extended  intervals. 

The  two  emergency  power  sequencer  checks  confirm  that,  in  the  event  of  a  major 
casualty  where  electrical  power  is  lost,  the  diesel  generators  are  sequentially  loaded  with 
safety  components.  The  safety  components  are  loaded  sequentially  to  ensure  that  the 
most  important  components  are  available  first,  and  to  prevent  dragging  the  diesel  offline 
from  the  simultaneous  start  of  all  vital  safety  loads.  The  sequencing  is  coordinated 
through  the  Solid  State  Protection  System  (SSPS).  With  the  exception  of  actually  loading 
the  diesel,  all  the  logic  cards  and  relays  can  be  checked  on  a  more  frequent  basis  with  the 
reactor  on-line  to  confirm  that  the  system  remains  functional.  Diesel  generator  load 
testing  is  performed  often  enough  to  confirm  that  the  diesel  generator  can  handle  the 
required  safety  load  package. 

The  offsite  power  transfer  operability  check  is  performed  to  ensure  that  the  plant 
emergency  buses  transfer  to  off-site  power  in  the  event  of  a  loss  of  on-site  power.  The 
relays  and  bus  transfer  equipment  are  extremely  reliable  and  past  performance  history 
confirms  that  the  surveillance  is  extendible  to  48  month  intervals. 
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The  Uninterruptable  Power  Supply  (UPS)  undervoltage  relay  checks  are 
comparable  to  the  undervoltage  relay  checks  described  in  section  3 . 1 .4.2.  The  Agastat 
time  delay  relay  cannot  be  checked  on-line,  but  its  performance  history  confirms  that  the 
testing  is  extendible  to  once  every  48  months. 


3.1. 9.3  Category  C  Surveillances 

There  are  not  Category  C  electrical  surveillances. 


3.1. 9.4  Summary  of  Electrical  Surveillances 

Table  3.10  compares  the  current  18  month  surveillance  program  for  electrical 
system  surveillances  to  the  recommended  surveillance  program  for  a  48  month  fuel  cycle 
based  on  the  justifications  provided  above. 

Electrical  Systems  Surveillance  Summary 


Table  3  - 10 


Cycle  Length 

Category  A 

Category  B 

Category  C 

18  Months 

32 

814 

— - 

48  Months 

824 

22 

0 

3.1.10  Technical  Requirements 
3.1.10.1  Discussion 

Technical  Requirements  are  surveillances  that  were  originally  part  of  the  technical 
specifications  that  a  utility  has  removed  from  the  technical  specifications  and  handles 
separately  with  the  permission  of  the  NRC.  Although  the  technical  requirements  are  part 
of  the  licensing  basis  for  the  plant  and  require  a  formal  Significant  Hazards  Evaluation 
(10CFR50.59)  to  change,  changes  can  be  approved  on-site  and  do  not  require  prior 
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approval  from  the  NRC  to  implement.  The  technical  requirements  cover  the  following 
major  areas: 

•  Loose  Parts  Detection 

•  Snubber  Inspections 

•  Fire  Pump  Operability  Checks 

•  Hydrant  and  Fire  Hose  Inspections 

•  Fire  Wrap/Fire  Seals/Fire  Damper  Inspections 

•  Carbon  Monoxide/Smoke  Detector  Calibrations 

•  Fire  Protection  System  Tests 

•  Fire  Accumulator  Inspections 


3.1.10.1  Category  A  Surveillances 

With  few  exceptions,  all  the  technical  requirement  surveillances  can  be  performed 
on-line.  The  vast  majority  of  fire  stations  and  fire  wrap  inspection  points  are  accessible 
with  the  reactor  on-line.  For  the  limited  number  that  are  inaccessible,  past  inspection 
history  and  the  availability  of  most  of  the  inspection  points  with  the  reactor  on-line 
provide  a  high  degree  of  confidence  that  the  inaccessible  points  can  be  deferred  to 
refueling  outages  at  48  months  or  made  part  of  a  hot  list  for  performance  during 
unplanned  shutdowns.. 

Snubber  inspections  and  functional  testing  require  the  most  attention.  In  the 
candidate  PWR  there  are  286  individual  snubbers.  There  are  two  main  types  of  snubbers 
in  use,  mechanical  and  hydraulic.  The  mechanical  snubbers  which  were  the  original 
design,  exhibit  higher  failure  rates  than  the  hydraulic  snubbers  because  they  are  more 
susceptible  to  system  vibration.  Testing  is  currently  performed  with  the  reactor  shutdown. 
Discussions  with  the  snubber  system  engineer  revealed  two  options  that  would  make  the 
snubber  testing  program  compatible  with  a  48  month  fuel  cycle.  First,  since  the  technical 
specifications,  which  are  the  original  basis  for  snubber  testing,  allow  a  snubber  to  be 
inoperable  for  up  to  72  hours,  plants  could  have  an  inventory  of  snubber  spares  that  could 
be  bench  tested  satisfactorily  and  then  swapped  with  in-place  snubbers  with  the  plant  on- 
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line.  The  replaced  snubber  could  subsequently  be  bench  tested  and  after  passing  its  bench 
test,  swapped  for  another  in-place  snubber  and  so  on.  This  technique  would  allow  on-line 
testing  and  still  keep  the  excess  inventory  of  snubbers  to  a  minimum.  Second,  mechanical 
snubbers  which  are  inaccessible  during  reactor  operation  should  be  replaced  with  the  more 
reliable  hydraulic  snubbers.  The  performance  history  of  hydraulic  snubbers  suggests  that 
testing  could  be  extended  to  48  months. 


3.1.10.2  Category  B  Surveillances 

As  discussed  above,  there  may  be  a  few  inaccessible  systems  which  cannot  have  a 
surveillance  performed  with  the  reactor  on-line.  In  these  few  cases,  material  history  and 
the  surveillance  record  of  the  accessible  systems  will  allow  interval  extension  to  48 
months. 


3.1.10.3  Category  C  Surveillances 

There  are  no  Category  C  technical  requirement  surveillances. 


3.1.10.4  Summary  of  Technical  Requirement  Surveillances 

Table  3.11  compares  the  current  18  month  surveillance  program  for  plant  technical 
requirement  surveillances  to  the  recommended  surveillance  program  for  a  48  month  fuel 
cycle  based  on  the  justifications  provided  above. 

Technical  Requirement  Surveillance  Summary 


Table  3-  11 


Cycle  Length 

Category  A 

Category  B 

Category  C 

18  Months 

53 

8 

— — 

48  Months 

61 

0 

0 
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3.1.11  Summary  of  Regulatory  Based  Surveillances 

Table  3.12  provides  a  complete  summary  of  the  PWR  regulatory  based 
surveillances.  The  table  compares  the  current  18  month  surveillance  program  to  the 
recommended  48  month  surveillance  program  described  in  this  chapter. 


Comparison  of  18  Month  Regulatory  Surveillance  Program 
versus  Recommended  48  Month  Program 

Table  3  -  12 


Current  18  Month 
Pi^gram 

Recommended  48  Month 
Program 

Tech  Spec 

Total  Reqts 

Oit-Line 

Off-Line 

Cat  A 

CatB 

CatC 

In-Service  Testing 

229 

60 

169 

147 

67 

15 

Reactivity  Control 

17 

12 

5 

13 

4 

0 

Power  Distribution 

17 

16 

1 

17 

0 

0 

Instrumentation 

436 

318 

118 

390 

44 

2 

Reactor  Coolant 

18 

8 

10 

13 

4 

1 

ECCS 

16 

6 

10 

9 

5 

2 

Containment 

81 

25 

56 

61 

20 

0 

Plant  Systems 

51 

41 

51 

0 

0 

Electrical 

846 

32 

mm 

824 

22 

Tech  Reqts 

61 

53 

8 

61 

0 

0 

Totals 

1772 

571 

1201 

1586 

166 

20 

The  thesis  48  month  regulatory  surveillance  program  recommends  moving  1013  of 
the  1201  surveillances  currently  performed  off-line  to  on-line  performance  modes.  This 
would  result  in  1586  of  the  1772  total  surveillances  (89%)  being  performed  on-line  as 
compared  to  the  current  571  of  1772  surveillances  (32%).  Even  discounting  the 
additional  792  electrical  system  surveillances  recommended  for  on-line  performance  which 
skews  the  numbers  somewhat,  the  recommended  48  month  regulatory  surveillance 
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program  moves  223  surveillances  currently  performed  off-line  to  on-line  performance 
modes.  This  increases  the  percent  of  non-electrical  surveillances  performed  on-line  from 
58%  (539  of  926)  to  82%  (762  of  926).  These  results  are  valuable  and  should  be 
considered  regardless  of  whether  a  48  month  cycle  is  implemented.  The  recommended 
program  reduces  the  number  of  regulatory  surveillances  required  to  be  performed  during 
24  month  refueling  outages  to  83  (166/2)  from  its  current  value  of  1201,  virtually 
guaranteeing  that  refueling  operations  will  be  the  critical  path  to  outage  completion.  The 
fewer  number  of  refueling  outage  surveillances  also  means  that  outside  contractor 
assistance  to  complete  refueling  outage  regulatory  surveillances  may  not  be  required.  This 
would  result  in  a  substantial  savings. 
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3.2  Investment  Protection  Surveillances 

Investment  protection  surveillances  include  all  the  non-technical-specification- 
based  surveillances  performed  at  the  candidate  PWR.  A  small  number  of  these 
surveillances  are  performed  as  a  result  of  a  commitments  to  agencies  other  than  the  NRC. 
In  general,  however,  the  investment  protection  surveillances  discussed  in  this  chapter  are 
those  whose  performance  mode  and  performance  interval  have  been  selected  at  the 
discretion  of  the  utility  to  protect  those  systems  and  components  with  significant 
investment  costs.  The  performance  modes  and  performance  intervals  are  selected  to 
ensure  that  the  reliability  of  the  selected  systems  and  components  offsets  the  cost  of 
performing  the  surveillance.  Unlike  the  technical  specification  based  surveillances 
discussed  in  section  3.1,  utilities  have  much  wider  latitude  in  choosing  which  surveillances 
to  perform  and  how  often  to  perform  them.  Additionally,  changes  to  investment 
protection  surveillance  performance  modes  or  performance  intervals  can  be  made  directly 
by  the  utility  without  a  lengthy  off  site  regulatory  approval  process.  Ultimately,  decisions 
as  to  whether  to  perform  and  how  often  to  perform  investment  protection  surveillances 
will  be  driven  by  how  these  particular  surveillances  change  the  Limiting  Plant  Event 
Frequency  (LPEF)  which  is  discussed  in  more  detail  in  Chapter  2. 

Investment  protection  surveillance  programs  are  likely  to  vary  widely  from  plant  to 
plant.  Because  of  this,  they  do  not  have  a  ready  classification  scheme  such  as  the  technical 
specification  sections  used  for  the  regulatory  based  surveillance  analysis.  To  provide  a 
logical  framework  to  analyze  the  investment  protection  surveillances,  surveillances  were 
grouped  by  system  and  placed  into  three  main  categories;  Nuclear  Steam  Supply  Systems 
(NSSS),  Balance  of  Plant  (BOP)  systems,  and  Electrical  systems.  Several  of  the  systems 
were  further  grouped  into  larger  categories,  such  as  main  turbine  systems  which  includes 
the  main  turbine  generator  and  all  its  associated  support  systems.  Figure  3-1  shows  the 
overall  structure  adopted  in  for  the  investment  protection  program  analysis. 
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Investment  Protection  Surveillance  Categorization 
Figure  3-1 
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Because  of  the  large  size  of  the  investment  protection  surveillance  program,  only 
those  investment  protection  surveillances  currently  performed  while  shutdown  were 
evaluated  for  compatibility  with  a  48  month  fuel  cycle.  There  are  over  1300  individual 
investment  protection  surveillances  currently  performed  while  shutdown  at  the  candidate 
PWR.  Of  these,  457  surveillances  have  performance  intervals  which  are  already  greater 
than  48  months  and  thus  are  already  compatible  with  a  48  month  fuel  cycle.  Many  of 
these  457  surveillances  are  electrical  surveillances  similar  to  those  discussed  in  section 
3.1.9.  Most  of  these  surveillances  can  be  performed  on-line.  They  will  be  discussed 
further  in  section  3.2.3. 

During  the  performance  of  the  investment  protection  surveillance  program 
analysis,  many  of  the  NSSS  and  BOP  systems  shown  in  figure  3-1  contained  surveillances 


92 


which  were  electrically  based.  This  included  items  such  as  motor-operated  valve 
inspections  and  cable  meggers,  unitized  starter  checks,  breaker  inspections,  and  current 
injection  testing  of  breakers.  In  these  cases,  these  surveillances  were  not  analyzed  as  part 
of  that  individual  system,  but  were  placed  in  the  “Motor  Operated  Valve“  and  “Other” 
Electrical  Systems  categories.  There  were  more  than  450  surveillance  items,  with  varying 
performance  intervals,  which  fell  into  these  two  categories.  This  classification  scheme 
resulted  in  a  system  analysis  which  contained  only  those  surveillances  unique  to  that 
system.  This  is  consistent  with  the  methodology  used  for  the  regulatory  based 
surveillances  discussed  in  section  3.1 


3.2.1  NSSS  Investment  Protection  Surveillances 

3.2.1. 1  Component  Cooling  (CC) 

3.2.1. 1.1  Category  A  Surveillances 

There  are  eight  CC  surveillances  currently  performed  shutdown  which  should  be 
considered  for  on-line  performance.  These  include  calibrations  of  the  four  thermal  barrier 
flow  indicating  switches  and  the  two  CC  supply  header  temperature  controls  for  the  CC 
heat  exchanger  outlet  and  bypass  valves.  Additionally,  the  inspection  and  lubrication 
surveillance  of  the  actuators  for  the  two  CC  heat  exchanger  outlet  and  bypass  valves  can 
be  performed  on-line.  The  temperature  control  calibrations  and  the  actuator  inspection 
and  lubrication  of  the  CC  heat  exchanger  outlet  and  bypass  valves  should  be  performed  at 
the  same  time  as  they  both  require  that  the  heat  exchanger  outlet  temperatures  be 
controlled  in  manual  during  surveillance  performance. 


3.2.1. 1.2  Category  B  Surveillances 

There  are  four  CC  surveillances  currently  performed  shutdown  which  cannot  be 
performed  on-line  whose  performance  intervals  are  already  compatible  with  a  48  month 
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fuel  cycle.  The  replacement  of  the  transducers  and  the  Bailey  positioners  for  the  CC  heat 
exchangers  temperature  control  valves  are  performed  every  14  years. 

3.2.1. 1.3  Category  C  Surveillances 

There  are  nine  Class  2  relief  valves  in  the  CC  system  which  cannot  be  tested  or 
replaced  on-line  and  whose  performance  history  will  not  ensure  reliable  operation  for  48 
months  between  testing  or  replacement.  Relief  valves  are  discussed  in  more  detail  in 
Chapter  4. 


3.2.1. 1.4  Summary  of  Component  Cooling  Surveillances 

Table  3.13  compares  the  current  18  month  surveillance  program  for  Component 
Cooing  to  the  recommended  surveillance  program  for  a  48  month  fuel  cycle  based  on  the 
justifications  provided  above. 

Component  Cooling  Surveillance  Summary 


Table  3  -  13 


Cycle  Length 

Category  A 

Categoiy  C 

18  Months 

21 

48  Months 

8 

4 

9 

3.2. 1.2  Rod  Control  (CP) 

3.2.1.2.1  Category  A  Surveillances 

There  are  six  rod  control  surveillances  currently  performed  while  shutdown  which 
should  be  considered  for  on-line  performance.  The  four  reactor  trip  breaker  inspections 
can  be  performed  on-line.  Each  breaker  has  an  associated  bypass  breaker  to  allow  on-line 
testing.  The  rod  drive  motor  generator  set  overcurrent  protective  relay  checks  are 
allowed  to  be  performed  on-line  with  special  permission  from  the  operations  manager. 
The  special  permission  required  from  the  operations  manager  recognizes  the  potential  for 
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an  unplanned  reactor  trip  if  the  surveillance  is  not  carefully  planned  and  executed.  Control 
Rod  Drive  Mechanism  (CRDM)  command  traces  can  be  obtained  during  the  weekly  step 
changes  performed  on  each  CRDM, 


3.2. 1.2.2  Category  B  Surveillances 

There  are  16  rod  control  surveillances  currently  performed  shutdown  which  cannot 
be  performed  on-line  but  which  can  be  performed  at  48  month  intervals  while  shutdown. 

The  control  rod  position  indication  operational  test,  rod  control  operability  test, 
and  the  foil  speed  and  direction  calibrations  are  similar  to  the  rod  position  issues  discussed 
in  section  3 . 1 .2.2.  As  long  as  the  plant  remains  at  power,  tests  of  the  rod  control  system 
which  confirm  its  operability  over  the  foil  range  of  rod  motion  are  not  required.  If 
however,  the  plant  shuts  down  after  more  than  1 8  months  since  the  performance  of  the 
last  rod  control  surveillance,  then  the  surveillances  should  be  performed  prior  to  reactor 
startup. 

There  are  five  clean  and  inspects  that  can  be  deferred  to  48  months.  Three  involve 
control  panel  clean  and  inspects  and  two  involve  rod  drive  motor  generators  inspections. 
To  support  the  deferment,  the  inspection  procedure  should  be  augmented  with  some  on¬ 
line  inspections.  On-line  inspections  must  be  limited  to  visual  inspections  of  the  cabinets 
and  motor  generators  for  loose  connections  and  dirt.  A  thermographic  inspection  of  the 
components  will  provide  additional  information  for  determining  if  they  require  an  actual 
clean  and  inspect.  The  component  louvers  can  also  be  covered  with  filtering  material, 
such  as  Scott  foam,  to  limit  the  amount  of  dust  and  dirt  entering  the  components.  The 
combination  of  visual  inspections  and  thermographic  inspections  with  the  addition  of 
filters  should  allow  deferment  of  the  actual  clean  and  inspect  to  refueling  periods.  Clean 
and  inspects  cannot  be  performed  on-line  due  to  the  dangers  of  working  around  energized 
gear  and  the  possibility  of  spurious  plant  trips  from  dislodging  various  wires  or  circuit 
cards  during  the  cleaning  process. 

The  rod  control  system  power  supply  has  eight  surveillances  which  can  be 
performed  at  48  month  intervals.  The  CRDM  stationary  gripper  fuses  are  currently 
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replaced  every  36  months.  Past  performance  indicates  that  the  fuses  are  likely  to  remain 
reliable  to  at  least  48  months.  The  rod  control  system  DC  power  supply  load  test  is 
performed  every  36  months.  Past  performance  indicates  that  the  power  supply  is  likely  to 
remain  in  specification  for  at  least  48  months.  The  five  breaker  inspections  involving  the 
motor  generators  and  their  power  supplies  are  currently  performed  at  54  month  intervals 
and  are  already  compatible  with  a  48  month  ftiel  cycle. 


3.2.1.2.3  Category  C  Surveillances 

There  are  no  Category  C  rod  control  surveillances. 


3.2.1.2.4  Summary  of  Rod  Control  Surveillances 

Table  3.14  compares  the  current  18  month  surveillance  program  for  Rod  Control 
to  the  recommended  surveillance  program  for  a  48  month  fuel  cycle  based  on  the 
justifications  provided  above. 

Rod  Control  Surveillance  Summary 


Table  3  - 14 


Cycle  Length 

Category  B 

Bim 

1 8  Months 

22 

— - 

48  Months 

6 

16 

0 

3.2.1.3  Chemical  Volume  and  Control  (CS) 

3.2.1.3.1  Category  A  Surveillances 

There  are  three  CS  surveillances  currently  performed  shutdown  which  should  be 
considered  for  on-line  performance.  The  regenerative  heat  exchanger  return  inlet  flow 
calibration  can  be  performed  on  line.  A  bypass  is  available  which  allows  the  flow  meter  to 
be  removed  from  service  for  calibration  without  interrupting  flow  to  the  heat  exchanger. 
The  flow  meter  is  used  to  gauge  long  term  flow  performance  of  the  system.  Short  term 
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removal  for  calibration  is  acceptable.  The  two  centrifugal  charging  pump  speed  increaser 
lube  oil  pump  couplings  can  be  inspected  on-line.  Only  one  of  two  charging  pumps  is 
required  at  a  time  with  the  reactor  at  power.  One  charging  pump  can  be  tagged  out  and 
the  surveillance  easily  conducted  within  an  LCO. 


3.2.1.3.2  Category  B  Surveillances 

There  are  three  CS  surveillances  currently  performed  shutdown  which  cannot  be 
performed  on-line  but  whose  performance  intervals  are  already  compatible  with  a  48 
month  fuel  cycle.  Both  centrifugal  charging  pumps  mechanical  seals  are  replaced  and  the 
bearings  inspected  once  every  four  to  six  years.  Depending  on  the  time  required  to 
replace  the  mechanical  seals  and  perform  the  bearing  inspections  these  two  surveillances 
could  be  considered  for  on-line  performance.  The  Rotork  valve  actuator  CS-V-1 89 
inspection  is  performed  every  54  months. 


3.2.1.3.3  Category  C  Surveillances 

There  is  one  Class  2  relief  valve  in  the  CS  system  which  cannot  be  tested  or 
replaced  on-line  and  whose  performance  history  does  not  ensure  reliable  operation  for  48 
months  between  testing  or  replacement.  Relief  valves  are  discussed  in  more  detail  Chapter 
4. 

3.2. 1.3.4  Summary  of  Chemical  Volume  and  Control  Surveillances 

Table  3.15  compares  the  current  18  month  surveillance  program  for  Chemical 
Volume  and  Control  to  the  recommended  surveillance  program  for  a  48  month  fuel  cycle 
based  on  the  justifications  provided  above. 
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Chemical  Volume  and  Control  Surveillance  Summary 


Table  3-15 


Cycle  Length 

Category  A 

Category  B 

Category  C 

1 8  Months 

7 

— — 

48  Months 

3 

3 

1 

3.2.1.4  Nuclear  Instrumentation  (NI) 

3.2.1.3.1  Category  A  Surveillances 

There  are  no  Category  A  NI  surveillances. 


3.2. 1.3.2  Category  B  Surveillances 

There  are  four  NI  surveillances  currently  performed  shutdown  which  cannot  be 
performed  on-line  but  whose  current  performance  interval  is  compatible  with  a  48  fuel 
cycle.  The  gammametrics  junction  box  o-rings  are  replaced  every  five  years.  The  JIO 
relays  for  the  excore  neutron  flux  monitoring  trains  are  replaced  every  48  months.  The 
incore  detectors  interconnecting  tube  removal  and  installation  is  performed  as  part  of  the 
refueling  sequence  and  is  independent  of  cycle  length. 


3.2. 1.3.3  Category  C  Surveillances 

There  are  no  Category  C  NI  surveillances 


3.2.1.3.4  Summary  of  Nuclear  Instrumentation  Surveillances 

Table  3.16  compares  the  current  18  month  surveillance  program  for  Nuclear 
Instrumentation  to  the  recommended  surveillance  program  for  a  48  month  fuel  cycle  based 
on  the  justifications  provided  above. 
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Nuclear  Instrumentation  Surveillance  Summary 


Table  3-16 


Cycle  Length 

Category  A 

Category  B 

Category  C 

1 8  Months 

— - 

4 

— 

48  Months 

0 

4 

0 

3.2.1.5  Reactor  Coolant  Systems(RC) 

3.2. 1.5.1  Category  A  Surveillances 

There  are  37  reactor  coolant  system  surveillances  currently  performed  shutdown 
which  should  be  considered  for  on-line  performance. 

The  14  temperature  calibrations  on  the  auctioneered  average  temperature,  loop 
delta  temperatures,  reactor  vessel  flange  leak  off  system,  pressurizer  surge  and  spray  lines, 
and  the  pressurizer  relief  discharge  lines,  can  be  performed  on-line.  The  instruments  are 
accessible  at  power.  They  provide  indications  and  in  some  cases  alarms  of  system 
temperatures,  but  provide  no  control  functions.  The  calibrations  can  safely  be  performed 
on-line  with  other  instruments  providing  enough  information  during  the  time  the 
instruments  are  removed  from  service  for  calibration. 

There  are  12  temperature  calibrations  performed  on  the  resistance  temperature 
detectors  (RTD)  used  to  monitor  the  upper  thrust  bearing,  upper  radial  bearing,  and  motor 
stator  winding  temperatures  for  each  reactor  coolant  pump.  The  calibrations  can  be 
performed  remotely  from  the  RTD’s  at  the  reactor  coolant  pump  temperature  monitoring 
panel.  Since  the  RTD’s  only  provide  temperature  indications  they  can  be  safely  removed 
from  service  for  short  periods  of  time  on-line  for  calibration. 

There  are  eight  non  technical  specification  relay  inspections  for  each  reactor 
coolant  pump  can  be  performed  on-line.  Each  reactor  coolant  pump  has  an  overcurrent 
relay  inspection  and  a  ground  fault  relay.  Both  relays  are  accessible  and  can  be  removed 
for  testing  without  impacting  on  the  operation  of  the  reactor  coolant  pumps. 
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Several  pressurizer  surveillances  are  allowed  to  be  performed  on-line  by 
procedure.  These  include  pressurizer  heater  loops  A  and  B  calibrations,  and  the 
pressurizer  level  calibrations. 

3.2.1.5.2  Category  B  Surveillances 

There  are  39  reactor  coolant  system  surveillances  currently  performed  shutdown 
which  cannot  be  performed  on-line  but  whose  performance  interval  is  either  already 
compatible  with  a  48  month  fuel  cycle  or  can  be  extended  to  48  months. 

Each  of  the  four  reactor  coolant  pumps  has  several  surveillances  which  are 
compatible  with  a  48  month  fuel  cycle.  Gaskets  on  each  reactor  coolant  pump  are 
replaced  once  every  12  years.  Each  reactor  coolant  pump  main  flange  area  is  currently 
inspected  once  every  18  months  for  boric  acid  buildup.  A  review  of  material  history  and 
discussions  with  the  reactor  coolant  pump  system  engineer  suggests  that  this  surveillance 
could  be  safely  extended  to  48  months.  A  routine  inspection  of  each  reactor  coolant  pump 
motor  is  performed  once  every  1 8  months.  This  routine  inspection  requires  that  the  pump 
and  motor  be  uncoupled  and  thus  requires  the  reactor  to  be  shutdown.  The  inspection  is  a 
vendor  recommended  inspection.  The  reactor  coolant  pumps  also  undergo  a  more 
detailed  inspection  every  four  to  five  years  when  the  motor  is  removed  and  sent  to  the 
vendor  for  a  complete  cleaning  and  overhaul.  Material  history  records  and  discussions 
with  the  reactor  coolant  pump  system  engineer  suggests  that  the  detailed  reactor  coolant 
pump  inspection  is  sufficient  to  maintain  reliable  operation  of  the  reactor  coolant  pumps. 
Each  of  the  three  mechanical  seals  on  the  reactor  coolant  pumps  is  inspected  and  replaced 
if  necessary  every  48  months. 

Several  pressurizer  related  surveillances  have  current  performance  intervals  of  at 
least  48  months.  The  pressurizer  heater  control  group  controller  inspection  is  performed 
every  nine  to  twelve  years.  The  pressurizer  heater  inspection  is  performed  every  48 
months.  The  pressurizer  vent  blank  flange  is  removed  and  reinstalled  to  facilitate 
maintenance  that  is  only  performed  during  refueling  outages  and  is  thus  independent  of 
refueling  interval. 
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The  installation  of  the  reactor  coolant  system  vent  and  fill  evacuation  system, 
reactor  coolant  system  draindown  system,  and  steam  generator  nozzle  dams  are  only 
performed  as  part  of  a  refueling  outage  and  are  independent  of  cycle  length.  In 
preparation  for  reactor  coolant  system  draindown.  the  reactor  coolant  system  ultrasonic 
level  instruments  are  calibrated. 

The  Valcor  solenoid  valves  on  the  liquid  sampling  system  are  replaced  every  five 

years. 

There  is  one  residual  heat  removal  suction  relief  valve  type  C  leak  test  which  will 
meet  the  10CFR50  Appendix  J  leak  test  requirements  and  only  needs  to  be  performed 
every  five  years. 


3.2. 1.5.3  Category  C  Surveillances 

There  are  eight  Reactor  Coolant  System  surveillances  which  cannot  be  performed 
on-line  and  whose  performance  intervals  cannot  be  extended  to  be  compatible  with  a  48 
month  fuel  cycle.  All  eight  surveillances  involve  the  four  Reactor  Coolant  Pumps  and  are 
discussed  in  more  detail  in  Chapter  4. 


3.2.1.5.4  Summary  of  Reactor  Coolant  System  Surveillances 

Table  3.17  compares  the  current  18  month  surveillance  program  for  Reactor 
Coolant  Systems  to  the  recommended  surveillance  program  for  a  48  month  fuel  cycle 
based  on  the  justifications  provided  above. 

Reactor  Coolant  System  Surveillance  Summary 


Table  3-17 


Cycle  Length 

Category  A 

Category  B 

Category  C 

18  Months 

84 

— 

48  Months 

39 

37 

8 
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3,2.1. 6  Residual  Heat  Removal  (RH)/Safety  Injection  (SI) 


3.2. 1.6.1  Category  A  Surveillances 

There  are  no  Category  A  RH/SI  surveillances 

3.2.1. 6.2  Category  B  Surveillances 

There  are  four  RH/SI  surveillances  currently  performed  shutdown  which  cannot  be 
performed  on-line  but  whose  performance  intervals  are  already  compatible  with  a  48 
month  fuel  cycle.  The  Namco  limit  switches  for  valves  RH-V-27,28,  and  49  are  replaced 
every  10  years  (counts  as  three  surveillances).  The  Valcor  solenoid  valves  for  the  nitrogen 
vents  to  Safety  Injection  Accumulators  A,  B,  C,  and  D  are  replaced  every  five  years  (all 
four  valves  are  replaced  as  part  of  a  single  surveillance). 


3.2.1. 6.3  Category  C  Surveillances 

There  are  no  Category  C  RH/SI  surveillances. 


3.2.1.6.4  Summary  of  Residual  Heat  Removal  (RH)/Safety  Injection  Surveillances 
(SI) 

Table  3.18  compares  the  current  18  month  surveillance  program  for  RH/SI 
surveillances  to  the  recommended  surveillance  program  for  a  48  month  fuel  cycle  based  on 
the  justifications  provided  above, 


RH/SI  Surveillance  Summary 
Table  3-18 


Cycle  Length 

Category  A 

Category  B 

Category  C 

1 8  Months 

4 

— - 

48  Months 

0 

4  1 

0 
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3.2,1. 7  Miscellaneous  NSSS  Systems  Surveillances 

Systems  which  did  not  interface  directly  with  the  reactor  coolant  system  were 
classified  as  miscellaneous  NSSS  systems.  These  included: 


Containment  Air  Purge  (CAP) 

1  Surveillance 

Chemical  Analysis  (CAS) 

16  Surveillances 

Containment  Building  Spray  (CBS) 

4  Surveillances 

Combustible  Gas  Control  (CGC) 

2  Surveillances 

Lead  Detection  (LD) 

9  Surveillances 

Nitrogen  Gas  (NG) 

2  Surveillances 

Head  Removal  (RE) 

29  Surveillances 

Radiation  Monitoring  (RM) 

10  Surveillances 

Spent  Fuel  Pool  (SF) 

6  Surveillances 

Waste  Gas  (WG) 

3  Surveillances 

3.2.1.7.1  Category  A  Surveillances 

There  are  44  miscellaneous  NSSS  system  surveillances  currently  performed 
shutdown  which  should  be  considered  for  on-line  performance.  These  include: 

•  16  hydrogen  monitor  instrument  calibrations 

•  9  leak  tests  on  various  personnel  and  equipment  hatches 

•  2  nitrogen  gas  system  auxiliary  relay  magnet  block  change  outs 

•  10  radiation  monitor  calibrations 

•  4  maintenance  items  on  the  spent  fuel  pools 

•  3  waste  gas  system  calibrations 
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3.2. 1.7.2  Category  B  Surveillances 

There  are  40  miscellaneous  NSSS  surveillances  currently  performed  shutdown 
whose  performance  intervals  already  support  a  48  month  cycle  or  whose  performance 
interval  can  safely  be  extended  to  48  months.  These  include: 

•  One  containment  air  purge  surveillance  involving  removal  of  temporary 
spoolpieces 

•  Two  containment  building  spray  Type  C  leak  rate  tests 

•  Two  containment  building  spray  refueling  outage  protective  cover  removals 

•  Containment  gas  control  temporary  spoolpiece  installation  and  removal 

•  29  Surveillances  involving  preparations  for  and  vessel  head  removal  for 
refueling 

•  Three  spent  fuel  surveillances  with  performance  intervals  of  54  months  or  more 


3.2.1.7.3  Category  C  Surveillances 

There  are  no  Category  C  miscellaneous  NSSS  system  surveillances. 


3.2.1. 7.4  Summary  of  Miscellaneous  NSSS  Systems  Surveillances 

Table  3.19  compares  the  current  18  month  surveillance  program  for  the 
miscellaneous  NSSS  surveillances  to  the  recommended  surveillance  program  for  a  48 
month  fuel  cycle  based  on  the  justifications  provided  above. 

Miscellaneous  NSSS  Surveillance  Summary 


Table  3  - 19 


Cycle  Length 

Category  A 

Category  B 

Category  C 

18  Months 

84 

■  - 

48  Months 

44 

40 

0 
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3.2.2  Balance  of  Plant  (BOP)  Investment  Protection  Surveillances 

3.2.2. 1  Auxiliary  Systems 

Auxiliary  systems  are  second  tier  systems  which  support  the  functions  of  the  major 
balance  of  plant  equipment  such  as  the  main  feedwater  pumps  and  the  main  turbine 
generator.  The  BOP  systems  classified  as  auxiliary  systems  include: 

•  Extraction  Steam  (EX)  -  1 3  surveillances 

•  Heater  Drains  (HD)  -  3 1  surveillances 

•  Moisture  Separator  Drains  (MD)  -  9  surveillances 

•  Miscellaneous  Vent  and  Drains  (MVD)  -  5  surveillances 

•  Steam  Generator  Blowdown  (SB)  -  6  surveillances 

•  Secondary  Component  Cooling  (SCC)  -  2  surveillances 

•  Steam  Seal  Supply  (SSS)  -  3  surveillances 

3.2.2.1.1  Category  A  Surveillances 

There  are  35  auxiliary  system  surveillances  currently  performed  shutdown  which 
should  be  considered  for  on-line  performance. 

Extraction  Steam  -  Three  extraction  steam  leak  checks  can  be  performed  on  line. 

Heater  Drains  -  The  two  heater  drain  pumps  have  six  surveillances  which  can  be 
performed  on-line.  The  recirculation  control  calibration  checks  can  be  performed  on-line 
by  placing  the  heater  drain  pump  recirculation  valves  in  manual  control  while  the 
calibration  checks  are  performed.  The  heater  drain  pump  upper  and  lower  motor  bearings 
oil  can  be  replenished  and  sampled  with  the  pumps  running.  Additionally,  the  two 
overcurrent  relay  inspections  for  these  two  pumps  are  allowed  on-line  by  procedure.  Each 
of  the  16  feedwater  heaters  level  control  calibrations  can  be  performed  on-line.  The 
calibrations  involve  both  the  level  control  valves  on  the  outlet  of  the  heaters  and 
calibrations  on  the  spill  valves  for  each  of  the  heaters.  The  calibrations  can  be  performed 
on-line  by  taking  manual  control  of  each  of  the  level  control  valves  during  the 
performance  of  the  calibrations.  The  heater  drain  tank  pressure  and  level  control 
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calibrations  can  also  be  performed  on-line  by  controlling  both  pressure  and  level  manually. 
Finally,  the  stroke  calibration  of  the  tempering  valves  to  the  heater  drain  pump  suctions 
can  be  performed  while  controlling  the  tempering  valves  in  manual. 

Moisture  Drains  -  The  calibration  of  the  four  moisture  separator  reheater  high  level 
systems  can  be  performed  on-line.  Each  reheater  has  three  level  switches  associated  with 
it.  Two  of  the  three  switches  must  sense  high  level  to  actuate  an  alarm  and  open  a  valve 
which  will  dump  water  from  the  reheater.  One  switch  at  a  time  can  be  removed  for 
calibration  with  the  plant  on-line  during  steady  state  operations. 

Secondary  Component  Cooling  -  The  SCO  supply  header  temperature  calibration 
can  be  performed  on-line  by  controlling  flow  manually  while  the  calibration  is  in  progress. 

Steam  Seal  Supply  -  Calibration  of  the  two  turbine  generator  steam  seal  pressure 
systems  can  be  performed  on-line  by  manually  controlling  steam  seal  supply  pressure  while 
the  calibration  is  in  progress. 

Performance  of  all  the  above  mentioned  calibrations  should  be  performed  during 
steady  state  operations  to  minimize  the  necessity  for  manual  adjustments  to  the  systems. 

If  load  changes  are  planned,  the  calibrations  should  be  deferred  to  limit  the  risk  of 
transients  in  the  associated  systems. 


3.2.2.1.2  Category  B  Surveillances 

There  are  36  auxiliary  systems  currently  performed  shutdown  whose  performance 
interval  is  compatible  with  a  48  month  fuel  cycle. 

Extraction  Steam  -  There  are  10  surveillances  which  perform  maintenance  on 
Gimpel  (Miller  Fluid)  Actuators  for  valves  in  the  extraction  steam  system.  These 
surveillances  have  a  current  performance  interval  of  54  months  and  thus  are  already 
compatible  with  a  48  month  cycle. 

Heater  Drains  -  The  alignment  of  the  level  control  systems  for  the  16  feedwater 
heaters  is  currently  performed  every  36  months.  The  candidate  PWR  is  considering 
extending  this  to  48  months  as  part  of  their  24  month  fuel  cycle  program.  Because  the 
calibrations  can  be  performed  on-line,  it  is  likely  that  the  alignments  only  need  to  be 


106 


performed  every  48  months  while  shutdown.  The  heater  drain  pump  rotating  assemblies 
are  scheduled  for  replacement  every  36  months.  Past  performance  history  of  the  pumps 
indicates  that  this  is  probably  excessive  and  would  therefore  support  at  least  a  48  month 
replacement  interval.  A  performance  based  system  which  determines  whether  the  rotating 
assembly  should  be  replaced  based  on  vibration,  lube  oil  analysis,  or  pump  operating 
characteristics  should  be  strongly  considered.  The  heater  drain  pumps  suction  strainers 
are  cleaned  every  1 8  months.  The  strainers  are  cleaned  following  prolonged  system 
shutdowns,  such  as  during  a  refueling  outage,  when  air  is  most  likely  to  enter  the  system 
and  cause  increased  levels  of  loose  general  corrosion  products  in  the  piping.  Once  the 
initial  system  cleanup  has  been  completed,  the  strainers  can  be  removed  for  full  power 
operations.  The  system  can  be  flushed  using  the  on  site  auxiliary  boiler  as  a  steam  and 
water  source  just  prior  to  the  end  of  a  refueling  period,  and  the  strainers  then  removed  for 
extended  cycle  operations.  The  heat  exchangers  for  the  heater  drain  systems  are  inspected 
every  18  months.  The  performance  history  for  these  stainless  steel  heat  exchangers 
suggests  that  their  inspection  frequency  could  safely  be  extended  to  48  months. 

Moisture  Drains  -  The  reheater  drain  tank  level  control  calibration  is  currently 
performed  every  54  months  and  is  therefore  already  compatible  with  a  48  month  fuel 
cycle. 

Steam  Generator  Blowdown  -  There  are  six  valves  in  the  SB  system  which  require 
ASCO  solenoid  valve  replacement  every  five  years.  These  six  surveillances  are  already 
compatible  with  a  48  month  fuel  cycle. 


3.2.2.1.3  Category  C  Surveillances 

There  are  seven  auxiliary  system  relief  valve  surveillances  which  cannot  be 
performed  on-line  and  whose  past  performance  makes  it  unlikely  that  the  performance 
interval  could  be  extended  to  48  months.  These  are  discussed  in  more  detail  in  Chapter  4. 
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3.2.2. 1.4  Summary  of  Auxiliary  System  Surveillances 

Table  3.20  compares  the  current  18  month  surveillance  program  for  BOP  Auxiliary 
Systems  to  the  recommended  surveillance  program  for  a  48  month  fuel  cycle  based  on  the 
justifications  provided  above. 


Auxiliary  Systems  Surveillance  Summary 
Table  3  -  20 


Cycle  Length 

Category  A 

Category  B 

Category  C 

1 8  Months 

— - 

83 

— - 

48  Months 

35 

41 

7 

3.2.2.2  Condensate  System 
3.2.2.2.1  Category  A  Surveillances 

There  are  14  condensate  surveillances  currently  performed  shutdown  which  should 
be  considered  for  on-line  performance. 

The  calibrations  of  the  Condensate  Storage  Tank  level  control  valve,  Condensate 
pump  recirculation  valves.  Feed  pump  seal  water  discharge  pressure  valves.  Feed  pump 
seal  water  differential  pressures  valves,  and  the  Main  Condenser  recirculation  valve  can  all 
be  performed  on-line  by  taking  manual  control  of  the  valves  during  performance  of  the 
calibrations. 

The  Condensate  pump  discharge  pressure  calibrations  can  be  performed  on-line. 
Only  two  of  the  three  condensate  pumps  are  required  for  full  power  operations.  The 
pumps  can  be  rotated  on-line  to  allow  performance  of  the  pressure  calibrations. 

The  Feed  pump  suction  header  pressure  switch  calibration  can  be  performed  on¬ 
line.  The  suction  header  pressure  provides  an  input  which  will  trip  the  Feed  pump.  The 
trip  occurs  on  a  two  of  three  logic  for  each  Feed  pump.  Each  pressure  switch  can  be 
removed  from  service  individually  for  calibration. 

The  Main  Condenser  boots  on  the  three  sections  of  the  Main  Condenser  are 
accessible  at  power  and  these  surveillance  inspections  can  also  be  performed  on-line. 
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3.2.2.2.2  Category  B  Surveillances 


There  are  no  Category  B  condensate  surveillances. 


3.2.2.2.3  Category  C  Surveillances 

There  are  three  condensate  surveillances  currently  performed  at  1 8  month  intervals 
which  cannot  be  performed  with  the  turbine  on-line  and  whose  performance  history  will 
not  allow  the  surveillance  performance  interval  to  be  extended  to  48  months.  All  three 
surveillances  involve  condenser  waterbox  maintenance.  They  are  possible  candidates  for 
performance  during  a  reduced  power  window  as  discussed  in  section  3.2.4.  They  are 
discussed  in  more  detail  in  Chapter  4. 


3.2.2.2.4  Summary  of  Condensate  System  Surveillances 

Table  3.21  compares  the  current  18  month  surveillance  program  for  the 
Condensate  System  to  the  recommended  surveillance  program  for  a  48  month  fuel  cycle 
based  on  the  justifications  provided  above. 

Condensate  System  Surveillance  Summary 


Table  3 -21 


Cycle  Length 

Category  A 

Category  B 

Category  C 

1 8  Months 

— 

17 

— 

48  Months 

14 

0 

3 

3.2.2.3  Circulating  Water/Service  Water  Systems 

Although  the  Circulating  Water  (CW)  and  Service  Water  (SW)  provide  cooling 
water  for  different  components  and  systems,  they  are  similar  in  terms  of  function  and  the 
source  of  water  they  use  as  the  cooling  medium.  Thus,  they  will  be  considered  together 
for  this  analysis. 
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3.2.2.3.1  Categonr'  A  Surveillances 

There  are  14  CW/SW  surveillances  currently  performed  shutdown  which  should  be 
considered  for  on-line  performance. 

There  are  twelve  surveillances  which  perform  checks  on  the  circulating  water 
system.  The  circulating  water  system  consists  of  three  pumps.  At  full  power,  all  three 
pumps  are  required.  The  requirement  is  based  on  a  maximum  allowed  temperature  rise  of 
20“  across  the  condenser  based  on  environmental  regulations.  Conversations  with  plant 
engineers  indicated  that  the  temperature  limit  can  be  observed  with  only  two  circulating 
water  pumps  up  to  92%  power.  Additionally,  the  candidate  PWR  is  investigating 
upgrading  the  existing  pumps  so  that  the  temperature  limits  can  be  observed  with  only  two 
pumps.  The  performance  of  circulating  water  surveillance  checks  which  require  a  pump  to 
be  removed  from  service  therefore  require  reduced  power  operations.  Three  of  the 
surveillances  check  that  the  circulating  pump  lubricating  water  low  flow  alarms  actuate  on 
a  loss  of  lubricating  water  to  the  circulating  water  pump.  Water  is  provided  to  the  stuffing 
box,  pump  bearing,  and  motor  bearing  for  each  of  the  three  one  third  capacity  circulating 
water  pumps.  To  check  each  flow  switch,  the  valve  providing  lubricating  water  to  that 
portion  of  the  pump  is  closed  momentarily  to  confirm  that  the  low  flow  alarm  actuates. 

The  traveling  screens  on  the  suction  of  each  pump  are  removed  for  inspection  every  18 
months  and  should  also  be  performed  while  each  pump  is  secured  for  other  testing.  The 
final  checks  that  should  be  performed  while  the  pump  is  secured  is  an  inspection  of  the 
lubricating  water  ports  to  the  stuffing  box  and  pump  bearings  and  an  inspection  of  the 
lubricating  water  ports  to  the  motor  bearing.  These  checks  could  be  delayed  if  the  flow 
checks  on  the  lubricating  water  piping  and  pump  and  motor  bearing  temperatures  show  no 
degrading  trend  in  performance.  A  review  of  past  performance  history  shows  that  the 
traveling  screen  inspection  takes  on  average  about  21  hours  to  perform.  Therefore  a  three 
day  reduced  power  window  is  needed  to  complete  all  three  traveling  screen  inspection 
surveillances. 

The  two  service  water  inspections  of  the  service  water  traveling  screens  are 
identical  to  those  for  the  circulating  water  system  and  should  be  scheduled  concurrently. 
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3.2. 2.3.2  Category  B  Surveillances 

There  are  five  CW/SW  surveillances  currently  performed  shutdown  which  cannot 
be  performed  on  line  but  whose  performance  interval  is  already  compatible  with  a  48 
month  fuel  cycle.  The  rotating  assemblies  for  the  three  circulating  water  pumps  and  the 
two  service  water  pumps  are  scheduled  for  replacement  every  54  months.  While  this  is 
already  compatible  with  a  48  month  cycle,  performance  monitoring  should  be  used  to 
determine  if  the  rotating  assemblies  require  replacement  this  frequently. 


3.2.2.3.3  Category  C  Surveillances 

There  are  no  Category  C  CW/SW  surveillances 

3.2.2.3.4  Summary  of  Circulating  Water/Service  Water  System  Surveillances 
Table  3.22  compares  the  current  18  month  surveillance  program  for  Circulating 

Water/Service  Water  Systems  to  the  recommended  surveillance  program  for  a  48  month 
fuel  cycle  based  on  the  justifications  provided  above. 


CW/SW  Surveillance  Summary 
Table  3  -  22 


Cyete  Length 

,  Category  A 

Category  B 

Category  C 

1 8  Months 

19 

— - 

48  Months 

14’ 

5 

0 

’All  14  at  reduced  power  (<92%) 


3.2.2.4  Diesel  Generator  Systems 
3.2.2.4.1  Category  A  Surveillances 

There  are  26  diesel  generator  surveillances  currently  performed  shutdown  which 
should  be  considered  for  on-line  performance.  Many  of  these  surveillances  can  be 
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performed  in  conjunction  with  technical  specification  based  diesel  generator  surveillances 
described  in  section  3. 1 .9.2  during  a  LCO.  Allowed  outage  times  of  up  to  14  days  have 
been  technically  justified  and  approved  by  the  NRC.  Additionally,  although  many  of  these 
surveillances  have  1 8  month  performance  intervals,  the  performance  intervals  should  be 
considered  for  extension  to  at  least  36  months  as  part  of  an  overall  diesel  generator 
inspection  program  switch  to  36  months  being  considered  within  the  nuclear  industry. 
Diesel  generator  surveillances  which  can  be  performed  in  conjunction  with  a  one  to  two 
week  allowed  technical  specification  outage  on  each  diesel  generator  include: 

-Air  cooling  water  temperature  control  loop  calibration 

-Pre-lube  oil  pump  suction  strainer  element  inspection 

-Biannual  exhaust  valve  removal  and  restoration 

-Air  start  system  air  receiver  inspection 

-Engine  cylinder  0-ring  replacement 

-Injector  cooling  water  header  inspection 

-Air  and  fluid  systems  leak  testing 

-Air  header  coupling  0-ring  replacement 

-Air  start  distributor  maintenance 

-Fuel  injection  pump  stud  inspection 

-Diesel  generator  insulation  check 

-Crankshaft  thrust  bearing  inspection 

-Turbo-charger  water  jacket  inspection 


3.2.2.4.2  Category  B  Surveillances 

There  are  two  diesel  generator  surveillances  currently  performed  shutdown  which 
cannot  be  performed  on-line  whose  performance  interval  is  already  compatible  with  a  48 
month  fuel  cycle.  The  two  emergency  power  sequencer  relay  inspections  require  the 
cabinets  to  be  deenergized  to  perform  the  cleaning  and  inspection  and  should  only  be 
performed  shutdown. 
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3.2.2. 4.3  Category  C  Surveillances 

There  are  no  Category  C  diesel  generator  surveillances. 

3.2.2.4.4  Summary  of  Diesel  Generator  System  Surveillances 

Table  3.23  compares  the  current  18  month  surveillance  program  for  Reactor 
Coolant  Systems  to  the  recommended  surveillance  program  for  a  48  month  fuel  cycle 
based  on  the  justifications  provided  above. 

Diesel  Generator  Surveillance  Summary 

Table  3  -  23 


Cycle  Length 

Category  A 

Category  B 

Category  C 

1 8  Months 

28 

— — 

48  Months 

26 

2 

0 

3.2.2.5  Main  Steam  System 
3.2.2.5.1  Category  A  Surveillances 

There  are  21  main  steam  surveillances  currently  performed  shutdown  which  should 
be  considered  for  on-line  performance.  The  steam  dump  control  calibration  can  be 
performed  on-line.  The  steam  dump  valve  has  manual  isolation  valves  upstream  and 
downstream  of  the  valve  which  will  allow  it  to  be  isolated  and  tested  on-line.  The 
lubrication  and  inspection  of  the  Terry  turbine  trip  and  throttle  valve  can  be  performed  on 
line  by  isolating  the  steam  supply  to  the  turbine.  The  turbine  provides  a  backup  feedwater 
source  and  can  be  removed  from  service  in  an  LCO.  The  thermographic  inspection  of 
pipe  chase  insulation  is  not  dependent  on  plant  status  and  should  be  performed  on-line. 
The  two  ASDV  noise  silencer  drain  line  inspections  are  typically  performed  offline 
because  manual  inspections  of  the  piping  are  dangerous  if  one  of  the  relief  valves  should 
lift  during  the  inspection.  However,  the  inspection  and  cleaning  of  the  piping  could  easily 
be  performed  with  remote  controlled  equipment  that  could  perform  both  the  inspection  of 
the  piping  and  removal  of  any  debris  without  subjecting  humans  to  the  dangers  of  possible 
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exposure  to  high  energy  steam.  Each  of  the  Main  Steam  Isolation  Valves  (MSIV)  has  two 
trains  of  instrumentation  which  provide  signals  to  shut  the  valves.  Each  train  can  be 
calibrated  individually  with  the  plant  at  power  by  taking  manual  control  of  the  MSIV’s. 
Each  MSIV  air  motor  lubrication  can  also  be  performed  on-line  during  an  LCO  with  the 
MSIV’s  controlled,  one  at  a  time,  in  manual. 

The  four  MSIV’s  have  both  investment  protection  and  regulatory  based 
surveillances  associated  with  them  which  are  currently  performed  shutdown,  but  which 
can  be  performed  on-line  if  plant  power  is  reduced  prior  to  surveillance  performance.  The 
four  investment  protection  surveillances  that  must  be  performed  at  reduced  power  during 
a  LCO  involve  periodic  maintenance  on  the  hydraulic  fluid  system  which  maintains  the 
four  MSIV’s  in  the  open  position.  The  hydraulic  fluid  is  drained,  the  fluid  reservoir 
cleaned,  and  the  in-line  filter  replaced  at  18  month  intervals.  This  can  be  done  on  one 
valve  at  a  time  and  the  plant  maintained  at  <75%  power.  All  the  main  steam  surveillances 
as  well  as  surveillances  from  other  systems  that  require  reduced  power  for  on-line 
performance  should  be  scheduled  concurrently  to  minimize  the  length  of  any  reduced 
power  window.  These  surveillances  are  summarized  in  section  3.2.4. 


3.2.2.5.2  Category  B  Surveillances 

There  are  nine  main  steam  surveillances  currently  performed  shutdown  which 
cannot  be  performed  on-line  but  whose  performance  intervals  would  be  compatible  with  a 
48  month  fuel  cycle.  The  valve  actuators  for  the  four  MSIV’s  and  MS-V-393  have  their 
solenoids  replaced  every  four  years.  The  elastometric  components  for  the  four  MSIV’s 
are  currently  replaced  every  three  years.  A  review  of  their  performance  history  suggests 
that  that  replacement  of  the  elastometric  components  can  safely  be  deferred  to  48  months. 


3.2.2.5.3  Category  C  Surveillances 

There  are  six  main  steam  relief  valve  surveillances  which  cannot  be  performed  on¬ 
line  and  whose  performance  history  will  not  allow  the  surveillance  performance  interval  to 
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be  safely  extended  to  48  months.  Chapter  4  provides  a  more  detailed  discussion  of  relief 
valve  surveillances. 

3.2.2.5.4  Summary  of  Main  Steam  System  Surveillances 

Table  3.24  compares  the  current  18  month  surveillance  program  for  the  Main 
Steam  System  to  the  recommended  surveillance  program  for  a  48  month  fuel  cycle  based 
on  the  justifications  provided  above. 

Main  Steam  Surveillance  Summary 


Table  3  -  24 


Cycle  Length 

Category  A 

Category  B 

Category  C 

1 8  Months 

— — 

39 

— 

48  Months 

21* 

12 

6 

*Four  at  reduced  power  (<75%) 


3.2.2.6  Feedwater  System 
3.2.2.6.1  Category  A  Surveillances 

There  are  45  feedwater  surveillances  currently  performed  shutdown  which  should 
be  considered  for  on-line  performance.  A  large  number  of  the  surveillances  involve  the 
two  50%  capacity  steam  driven  main  feed  pumps.  Calibrations  of  instruments  which  only 
provide  alarms  or  valve  control  of  valves  which  can  also  operated  in  manual,  are  readily 
adaptable  to  on-line  performance.  These  instruments  typically  have  isolation  valves  which 
allow  them  to  removed  on-line  for  calibration.  The  parameters  measured  by  these 
instruments  can  be  monitored  locally  during  the  performance  of  the  calibrations  to  ensure 
they  are  remaining  within  specification.  Instruments  which  provide  signals  to  trip  the  feed 
pumps  or  control  the  level  in  the  steam  generators  are  more  delicate  to  calibrate  on-line 
because  improper  performance  could  result  in  significant  plant  transients.  These 
instruments  typically  have  two  or  more  sensors,  with  multiple  sensor  inputs  required  to 
initiate  the  trip.  If  a  plant  analysis  shows  that  there  is  a  significant  change  in  the  plant  trip 
frequency  by  performing  these  types  of  calibrations  on-line,  then  consideration  should  be 
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given  to  performing  the  calibrations  during  a  reduced  power  window  where  steam 
generator  level  is  much  easier  to  control  in  manual  or  the  loss  of  one  main  feed  pump 
would  not  result  in  a  plant  transient  large  enough  to  cause  a  plant  trip.  Individual 
surv'eillances  are  described  below  based  on  their  function  in  the  feedwater  system. 

Alarms  and  Control.  The  main  feed  pump  recirculation  flow  indication  and  control 
is  designed  to  ensure  that  the  main  feed  pumps  maintain  a  minimum  flow  of  7,000  gallons 
per  minute.  The  recirculation  valves  can  be  controlled  in  manual  locally  during  testing  and 
calibration.  The  main  feed  pump  pressure  and  speed  indication  alarms  can  be  calibrated 
on-line.  Pressure  and  speed  indications  can  be  monitored  manually  during  performance  of 
the  pressure  switch  calibrations.  The  main  feed  pump  discharge  pressure  alarms  can  be 
calibrated  on-line  and  the  discharge  pressure  monitored  during  performance  of  the  test  to 
ensure  it  remains  within  specification.  The  main  feed  pump  oil  pump  discharge  pressure 
calibrations  are  currently  performed  every  four  years  while  shutdown.  However,  these 
calibrations  can  safely  be  performed  on-line  by  placing  either  the  alternate  or  emergency 
oil  pumps  on  the  line  in  manual. 

Trips  and  Feedwater  Regulating  Valve  fFRyf  Control.  The  main  feed  pump 
turbine  bearing  oil  and  low  vacuum  trip  switch  calibrations  can  be  performed  on-line. 

Each  pump  contains  two  switches  which  can  be  bypassed,  one  at  a  time,  for  testing.  The 
main  feed  pump  emergency  oil  pump  pressure  switch  calibration  can  be  performed  on-line 
by  placing  the  emergency  lube  oil  pump  in  run  and  swapping  the  pressure  switch,  which 
turns  the  pump  on  upon  sensing  low  lube  oil  pressure  in  the  pump,  with  a  bench  tested 
spare.  The  main  feed  pump  turbine  trip  header  oil  pressure  calibration  is  similar  to  the 
pump  oil  pressure  calibration  and  can  also  be  performed  on-line.  The  four  surveillances 
which  check  the  position  indication  and  stroke  times  of  the  feedwater  regulating  valves 
requires  power  to  be  less  than  1 5%  to  perform  to  prevent  excessive  changes  in  steam 
generator  levels  during  the  valve  strokes.  These  four  surveillances  should  be  planned 
during  a  reduced  power  window.  During  performance  of  the  surveillances  steam 
generator  levels  can  be  controlled  using  the  feedwater  regulating  valve  bypass  valves 
which  are  designed  to  control  steam  generator  levels  with  power  less  than  15%.  The 
bypass  valves  to  the  feedwater  regulating  valves  can  be  calibrated  and  stroked  with  the 
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plant  at  power  as  long  as  the  feedwater  regulating  valves  and  the  steam  generator  water 
level  control  system  are  maintained  in  the  automatic  mode.  The  main  feed  pump  suction 
header  pressure  is  monitored  by  three  individual  pressure  switches.  Two  of  the  three 
pressure  switches  are  required  to  cause  a  main  feed  pump  trip.  Each  switch  can  be 
calibrated  individually  on-line.  The  main  feed  pump  speed  control  calibrations  can  only  be 
performed  with  the  main  feed  pump  secured.  This  surveillance  will  require  a  reduced 
power  window  so  that  one  pump  at  a  time  can  be  secured  for  speed  control  calibrations. 

The  steam  generator  steam  and  feedwater  flow  instruments  provide  inputs  into  the 
steam  generator  water  level  control  system  (SG^^^-C).  Calibration  of  these  instruments 
can  be  performed  by  idling  one  steam  generator  (securing  all  feeding  and  steaming)  at  a 
time  and  performing  the  calibration  of  the  associated  steam  and  feedwater  flow 
instruments.  In  this  way,  the  SGWLC  system  will  not  receive  inputs  from  the  idled  steam 
generator  instruments  and  will  be  able  to  properly  control  level  in  the  three  remaining 
steam  generators  with  the  plant  at  approximately  75%  power.  Past  performance  records 
indicates  that  the  calibrations  on  each  steam  generator  feed  and  steam  flow  instruments 
takes  approximately  24  hours. 

The  four  steam  generator  feedwater  isolation  valves  have  two  surveillances  each 
which  can  be  performed  on-line  during  a  reduced  power  window.  The  feedwater  isolation 
valves  are  designed  to  sense  rapid  drops  in  steam  generator  pressure  caused  by  a  steam 
line  rupture  and  shut  just  upstream  of  the  steam  generator  to  stop  the  steam  rupture.  Each 
feedwater  isolation  valve  has  three  Borg  Warner  pressure  switches,  two  of  which  are 
required  to  actuate  to  trip  the  valve.  The  testing  of  the  switches  requires  that  the 
feedwater  isolation  valves  be  cycled  several  times.  This  can  only  be  performed  with  the 
steam  generator  idled  and  the  plant  at  reduced  power  below  75%.  Prior  to  completing  the 
pressure  switch  tests,  the  surveillances  which  clean  and  replace  the  lube  oil  to  the 
feedwater  isolation  valve  actuators  should  be  performed.  These  surveillances  can  also  be 
performed  during  a  reduced  power  window  with  the  steam  generators  idled  one  at  a  time. 

The  Startup  Feed  pump  is  used  to  control  steam  generator  level  with  power  less 
than  three  percent.  With  the  plant  at  power,  the  pump  can  be  removed  from  service  and 
the  surveillances  which  check  the  overcurrent  relay,  ground  detection  relay,  perform  trip 
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checks  on  the  output  breaker,  and  change  the  grease  on  the  pump  coupling  performed  on¬ 
line,  Shaft  voltage  checks  between  the  main  feed  pump  and  main  feed  pump  turbine  are 
external  measurements  and  can  be  performed  on-line.  The  inspection  of  the  brushes  on 
the  DC  motors  for  the  two  lube  oil  pumps  associated  with  each  main  feed  pump  can  be 
performed  one  at  a  time  with  the  main  feed  pump  running  and  the  plant  at  power. 


3.2.2.6.2  Category  B  Surveillances 

There  are  1 5  feedwater  surveillances  currently  performed  shutdown  which  cannot 
be  performed  on-line  but  whose  performance  interval  are  already  compatible  with  a  48 
month  fuel  cycle.  The  main  feed  pump  oil  tank  levels  and  temperatures  are  currently 
checked  every  72  months  and  are  already  compatible  with  a  48  month  cycle.  Depending 
on  the  time  required  to  perform  the  surveillance,  they  should  be  considered  for 
performance  during  a  reduced  power  window  when  the  main  feed  pump  is  removed  from 
service  for  the  performance  of  other  surveillances.  The  main  feed  pump  turbine  governor 
speed  control  and  valve  position  calibrations  are  currently  performed  every  48  months  and 
are  already  compatible  with  a  48  month  fuel  cycle.  The  four  differential  pressure 
transmitters  for  the  feedwater  regulating  valves  are  replaced  every  13  years.  The 
diaphragm  on  the  four  feedwater  regulating  valve  bypasses  are  replaced  every  54  months. 
The  four  motor  operated  valves  for  the  emergency  feedwater  system  are  tested  every  54 
months. 


3.2.2.6.3  Category  C  Surveillances 

There  are  no  Category  C  feedwater  system  surveillances.  Many  of  the  Category  A 
surveillances  require  reduced  power  operations  including  idling  of  individual  steam 
generators.  Each  individual  utility  will  have  to  make  a  decision  as  to  whether  they  feel  it  is 
cost  effective  to  operate  at  reduced  power  during  performance  of  these  feedwater  system 
surveillances. 
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3.2.2. 6.4  Summary  of  Feedwater  System  Surveillances 

Table  3.25  compares  the  current  18  month  surveillance  program  for  the  Feedwater 
System  to  the  recommended  surveillance  program  for  a  48  month  fuel  cycle  based  on  the 
justifications  provided  above. 

Feedwater  System  Surveillance  Summary 


Table  3  -  25 


Cycle  Length 

Category  A 

Category  B 

Category  C 

1 8  Months 

— — 

60 

— — 

48  Months 

45* 

15 

0 

*17  at  reducec 

power  levels  from  <75%  to  <15% 

3.2.2.7  Main  Turbine  Systems 

The  main  turbine  system  surveillances  consist  of  surveillances  for  the  main  turbine 
and  generator  as  well  as  the  key  support  systems  which  support  turbine  generator 
operation.  The  main  turbine  systems  include; 

•  Electrohydraulic  Control  System  (EHC)  24  surveillances 


Generator  Stator  Cooling  (GSC) 
Hydraulic  Fluid  (HF) 

Lube  Oil  (LO) 

Turbine  Generator  (TG) 

Turbine  Support  (TSI) 
Miscellaneous  Procedures  (MM) 


11  surveillances 
3  surveillances 
9  surveillances 
6  surveillances 
5  surveillances 
16  surveillances 


3.2.2.7.1  Category  A  Surveillances 

There  are  49  main  turbine  systems  surveillances  which  are  currently  performed 
shutdown  which  should  be  considered  for  on-line  performance. 
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EHC.  Twenty  two  EHC  surveillances  currently  performed  shutdown  should  be 
considered  for  on-line  performance  during  a  reduced  power  window  with  the  main  turbine 
secured.  The  EHC  system  flow  demand  signal  indication  calibrations  and  the  thrust 
bearing  wear  detector  indication  loop  calibrations  can  be  performed  on-line.  Neither 
signal  provides  an  input  which  could  cause  a  turbine  and  plant  trip.  The  calibrations  of  the 
turbine  generator  first  stage  pressure,  intermediate  stage  pressure,  throttle  pressure 
transducers,  as  well  as  the  calibration  of  the  turbine  generator  emergency  trip  system 
pressure  switches  and  master  trip  pressure  switches  must  be  performed  with  the  main 
turbine  tripped.  Thus,  these  calibrations  must  be  performed  during  a  reduced  power 
window.  Past  maintenance  records  indicate  that  the  calibrations  require  about  24  hours  to 
perform.  During  performance  of  the  transducer  and  pressure  calibrations,  several  EHC 
electrical  surveillances  should  also  be  scheduled  for  performance  including  cabinet  clean 
and  inspects,  power  supply  adjustments,  voltage  comparator  checks,  and  terminal  box 
internal  wiring  checks.  While  the  turbine  is  secured,  the  turbine  generator  speed  probe 
gap  measurements  and  speed  cable  integrity  checks  which  also  require  the  turbine  to  be 
secured  can  also  be  performed.  Finally,  the  eight  turbine  generator  servo  valve  strainer 
assembly  replacements  require  the  turbine  to  be  secured  and  should  be  scheduled  during 
the  reduced  power  window.  Based  on  historical  records,  strainer  replacements  take  one 
to  two  hours  to  complete. 

GSC.  The  GSC  system  which  removes  heat  from  the  generator  stator  contains 
two  pumps,  each  of  which  is  capable  of  providing  the  necessary  flow  to  remove  the  heat 
from  the  helium  gas  used  to  cool  the  generator  stator.  There  are  1 1  GSC  surveillances 
currently  performed  shutdown  which  should  be  considered  for  on-line  performance.  Four 
of  these  surveillances  are  recommended  for  performance  with  the  main  turbine  secured  as 
part  of  the  trip  avoidance  program  and  thus  should  be  scheduled  during  a  reduced  power 
window.  These  include  switch  calibrations  for  the  GSC  water  pressure,  inlet  flow  low, 
and  turbine  generator  bushing  coolant  flow.  The  remaining  seven  surveillances  are  not 
part  of  the  trip  avoidance  program  and  could  be  scheduled  for  performance  during  any  on¬ 
line  maintenance  period.  Plants  may  want  to  combine  these  surveillances  with  the  four  trip 
avoidance  surveillances  and  complete  all  the  GSC  surveillances  during  the  reduced  power 
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window  if  the  additional  surveillances  are  not  the  critical  path  to  returning  to  power. 

These  surveillances  include  water  inlet  pressure  control  calibrations,  GSC  cooling  pumps 
low  pressure  switches,  stator  coolant  resin  replacement,  turbine  generator  bushing  coolant 
flow  calibration,  GSC  water  temperature  control  calibrations,  rectifier  cooling  water  inlet 
drain  pressure  low  calibration,  and  undercurrent  relay  inspections  of  the  GSC  control 
panel.  These  seven  surveillances  only  provide  indications  as  opposed  to  the  trip  signals 
provided  by  the  first  four  surveillances. 

HF.  The  hydraulic  fluid  system  provides  the  high  pressure  hydraulic  fluid  to  the 
EHC  control  valves.  There  are  two  hydraulic  fluid  pumps,  only  one  of  which  is  required 
at  any  time  to  maintain  system  pressure.  There  are  three  HF  surveillances  currently 
performed  shutdown  which  should  be  considered  for  on-line  performance.  The  three 
surveillances  test  the  low  pressure  start  features  of  each  pump,  the  hydraulic  fluid  low  trip 
pressure  switch,  and  hydraulic  pump  filter  differential  pressure  switch.  Each  test  can  be 
performed  on  a  standby  pump,  with  the  pump  in  standby  alternated  with  the  on-line  pump 
to  complete  all  the  surveillance  testing. 

LQ.  There  are  five  lube  oil  surveillances  currently  performed  shutdown  which 
should  be  considered  for  on-line  performance.  The  main  turbine  low  shaft  pump  discharge 
pressure  and  low  bearing  oil  pressure  calibrations  require  the  main  turbine  to  be  shutdown 
during  their  performance  and  thus  should  be  scheduled  during  a  reduced  power  window. 
The  thrust  bearing  wear  detector  trip  consists  of  four  pressure  switches,  with  two  of  the 
four  switches  required  to  cause  a  turbine  trip.  One  switch  at  a  time  can  be  safely  removed 
for  calibration  with  the  plant  on-line.  The  turbine  generator  bearing  temperature  detectors 
can  be  removed  for  inspection  and  bearing  temperatures  monitored  with  the  use  of  a 
surface  pyrometer  during  the  short  inspection  interval.  The  main  turbine  has  three  lube  oil 
pumps.  The  primary  pump  is  run  directly  off  the  turbine  shaft.  The  two  standby  electric 
lube  oil  pumps  are  for  emergency  use.  Their  DC  motors  can  be  inspected,  one  at  a  time, 
with  the  turbine  on-line. 

TG.  There  are  three  TG  surveillances  currently  performed  shutdown  which  should 
be  considered  for  on-line  performance.  The  excitation  and  shaft  grounding  inspection, 
installation  and  removal  of  the  turning  gear  remote  jog  switch  are  both  allowed  to  be 
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performed  on-line  by  procedure  and  do  not  increase  the  likelihood  of  a  main  turbine  trip. 
The  exciter  power  rectifier  Teflon  tube  inspection  can  also  be  performed  on-line.  The 
tubes  are  translucent  and  thus  the  inspections  can  be  performed  without  tube  removal  by 
backlighting  each  tube  with  a  strong  light  beam. 

TSI.  There  are  five  turbine  support  instrument  surveillances  currently  performed 
on-line  which  should  be  considered  for  on-line  performance.  All  the  surveillances  involve 
calibration  of  the  turbine  water  spray  systems. 


3.2.2.7.2  Category  B  Surveillances 

There  are  21  main  turbine  systems  surveillances  which  cannot  be  performed  on-line 
but  whose  performance  interval  can  made  compatible  with  a  48  month  fuel  cycle. 

EHC.  Several  miscellaneous  turbine  indicator  checks  are  already  performed  at  48 
month  intervals.  The  electronic  trip  solenoid  valve  (ETSV)  filter  replacement  is  currently 
conducted  every  54  months. 

LO.  There  are  two  LO  surveillances  which  cannot  be  performed  on-line  but  which 
have  performance  intervals  greater  than  48  months  and  are  thus  already  compatible  with  a 
48  month  cycle.  The  lube  oil  temperature  indicator  calibrations  are  currently  performed 
every  nine  years.  The  lube  oil  control  circuit  relay  and  breaker  checks  are  performed  once 
every  54  months. 

TG.  There  are  three  TG  surveillances  performed  on  the  generator  exciter  currently 
performed  off-line  which  cannot  be  performed  on-line  but  whose  performance  interval  is 
already  compatible  with  a  48  month  cycle.  The  exciter  inspection  and  field  polarity 
reversal  are  currently  performed  every  eight  years.  The  exciter  field  rotor  removal  and 
installation  is  currently  performed  every  54  months. 

MM.  There  are  16  miscellaneous  procedures  performed  on  the  main  turbine  which 
cannot  be  performed  on-line  but  whose  performance  interval  can  be  made  or  is  already 
compatible  with  a  48  month  cycle.  The  main  generator  megger/field  resistance  check  is 
currently  performed  every  18  months.  A  review  of  past  material  records  showed  that  the 
megger  and  resistance  checks  were  satisfactory  during  each  check  over  the  past  six  years. 
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Additionally,  a  ground  detection  system  continually  monitors  the  generator  and  will  give 
indications  of  possible  degradation  in  generator  resistance  between  inspections.  This 
surveillance  should  be  extended  to  48  months.  There  are  13  surveillances  which  perform 
major  inspections  of  the  high  pressure  and  low  pressure  turbines,  generator  rotor,  and  all 
the  associated  bearings  for  the  turbine  and  generator.  These  surveillances  are  currently 
scheduled  once  every  72-96  months  and  are  compatible  with  a  48  month  fuel  cycle.  The 
generator  field  polarity  reversal  is  also  only  performed  once  every  72-96  months.  The 
turbine  generator  lay-up  procedure  is  performed  during  prolonged  shutdowns  and  is 
independent  of  cycle  length. 


3.2.2.7.3  Category  C  Surveillances 

There  are  no  Category  C  Main  Turbine  Systems  surveillances.  Many  of  the 
Category  A  surveillances  require  reduced  power  operations  including  securing  of  the  main 
turbine  with  the  reactor  on-line.  Each  individual  utility  will  have  to  make  a  decision  as  to 
whether  they  feel  it  is  cost  effective  to  keep  the  turbine  idle  for  several  days  with  the 
reactor  on-line  for  surveillance  testing.  This  issue  is  discussed  in  more  detail  in  Section 
3.2.4. 


3.2.2.7.4  Summary  of  Main  Turbine  Systems  Surveillances 

Table  3.26  compares  the  current  18  month  surveillance  program  for  Main  Turbine 
Systems  to  the  recommended  surveillance  program  for  a  48  month  fuel  cycle  based  on  the 
justifications  provided  above. 

Main  Turbine  Surveillance  Summary 


Table  3  -  26 


Cycle  Leiigtii 

Category  C 

18  Months 

72 

— 

48  Months 

49* 

23 

0 

*28  at  reduced 

power  with  main  turbine  secured  (<20%) 
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3.2. 2. 8  Miscellaneous  BOP  Systems 

There  are  several  investment  protection  surveillances  performed  on  systems  which, 
with  few  exceptions,  have  no  direct  impact  on  the  operation  of  the  balance  of  plant 
equipment.  These  include  surveillances  involving  fuel  handling  equipment,  lighting, 
miscellaneous  procedures,  vibration  analysis,  and  the  public  address  system. 

3.2.2. 8.1  Category  A  Surveillances 

There  are  93  miscellaneous  BOP  system  surveillances  which  should  be  performed 
on-line.  These  include  all  the  surveillances  dealing  with  fuel  handling  equipment  (36), 
lighting  (3),  vibration  analysis  (22),  public  address  systems  (8),  and  24  of  the  33 
miscellaneous  procedures. 


3.2.2.8.2  Category  B  Surveillances 

There  are  nine  miscellaneous  procedures  currently  performed  shutdown  which 
cannot  be  performed  on-line  but  whose  performance  intervals  are  already  compatible  with 
a  48  month  fuel  cycle.  Four  of  the  nine  surveillances  perform  inspections  of  various  plant 
control  panels  at  48  month  intervals.  The  other  five  surveillances  involve  various 
containment  hatch  removals  and  installations  which  are  only  performed  as  part  of  a 
refueling  outage  and  thus  are  independent  of  fuel  cycle  length. 


3.2.2.8.3  Category  C  Surveillances 

There  are  no  miscellaneous  BOP  system  Category  C  surveillances. 


3.2.2.8.4  Summary  of  Miscellaneous  BOP  System  Surveillances 

Table  3.27  compares  the  current  18  month  surveillance  program  for  the 
miscellaneous  BOP  systems  to  the  recommended  surveillance  program  for  a  48  month  fuel 
cycle  based  on  the  justifications  provided  above. 
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Miscellaneous  BOP  Surveillance  Summary 
Table  3  -  27 


Cycle  Length 

Category  A 

Category  B 

18  Months 

— 

102 

— 

48  Months 

93 

9 

0 

3.2.3  Electrical  System  Investment  Protection  Surveillances 

Electrical  related  surveillances  make  up  more  than  half  (690  of  1336)  of  the  total 
investment  protection  surveillances  performed  at  the  candidate  PWR.  As  with  the 
regulatory  based  electrical  surveillances,  the  vast  majority  of  these  surveillances  can  be 
performed  on-line.  Additionally,  most  of  these  surveillances  also  have  current 
performance  intervals  which  are  already  compatible  with  a  48  month  fuel  cycle.  Because 
it  was  too  time  consuming  and  not  of  significant  generic  value,  each  of  the  electrical 
surveillances  was  not  checked  to  determine  its  optimum  performance  category.  Each 
individual  utility  will  have  to  determine  the  proper  mix  of  on-line  and  off-line  performance 
for  their  plant  which  can  be  both  safely  and  economically  performed.  The  electrical 
system  surveillances  were  broken  into  five  principal  categories.  These  areas  are: 

•  Motor  Operated  Valves  119  surveillances 

•  Electrical  Distribution  109  surveillances 

•  Emergency  Electrical  Distribution  67  surveillances 

•  Switchyard  64  surveillances 

•  Other  331  surveillances 

Switchboard  clean  and  inspects  are  a  major  class  of  electrical  surveillances  which 

will  likely  have  to  be  performed  more  often  than  once  every  48  months.  Because  of  the 
high  voltages  in  many  of  the  switchboards,  it  is  essential  to  that  they  be  kept  clean  to 
minimize  the  risk  of  arching  damage  and  potential  electrical  fires.  Cleanliness  levels  can  be 
improved  by  installation  of  simple  filter  pads  on  the  louver  areas  of  the  switchboards. 
Thermographic  inspections  may  also  be  used  to  help  determine  any  impending  hot  spots  in 
the  switchboards  which  may  require  further  investigation. 
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3.2.4  Surveillances  Requiring  Reduced  Power  Windows 

There  are  a  large  number  of  investment  protection  surveillances  which  can  only  be 
performed  on-line  if  the  plant  is  operated  at  reduced  powers.  Most  of  these  surveillances 
also  have  performance  intervals  well  short  of  48  months  and  thus  a  decision  must  be  made 
as  to  whether  to  shutdown  or  perform  the  surveillances  at  reduced  power  with  the  reactor 
on-line.  Because  utilities  have  much  wider  latitude  in  choosing  the  performance  interval 
and  performance  mode  of  these  surveillances,  each  individual  utility  will  have  to  determine 
the  safest  and  most  economic  way  to  perform  each  of  these  surveillances. 

Performance  of  the  surveillances  in  a  reduced  power  window  offers  several  major 
advantages  when  compared  to  shutting  down  to  perform  the  surveillances.  First,  the  time 
to  recover  the  plant  to  full  power  following  surveillance  performance  is  significantly 
reduced.  In  the  case  of  surveillances  which  do  not  require  the  main  turbine  to  be  secured, 
return  to  full  power  can  be  accomplished  in  a  matter  of  hours.  Secondly,  by  maintaining 
the  reactor  plant  and  the  steam  plant  hot,  fewer  thermal  cycles  over  the  life  of  the  plant 
will  be  required.  On-line  performance  also  does  not  require  the  major  changes  in  both 
reactor  and  steam  generator  chemistry  that  is  required  following  shutdown.  Finally, 
historically,  plant  equipment  problems  often  occur  on  equipment  that  has  been  returned  to 
service  following  shutdown,  even  though  that  same  equipment  had  been  running  reliably 
prior  to  the  shutdown. 

On-line  performance  of  the  many  of  these  surveillances  does  have  some 
disadvantages.  Because  the  plant  is  still  at  power,  the  possibility  of  a  plant  trip  or 
transient  is  possible  even  though  the  reduced  power  condition  should  eliminate  most  of 
these  concerns.  Most  importantly,  for  those  surveillances  which  require  the  main  turbine 
to  be  secured,  the  reactor  is  producing  power  and  burning  fuel  but  is  not  producing 
revenue  generating  electricity.  Thus  the  economic  penalty  from  burning  the  fuel  may  be 
greater  than  the  extra  time  required  to  bring  the  plant  back  to  full  power  from  a  shutdown 
condition.  If  this  is  the  case,  the  utility  should  opt  to  shut  the  plant  down  for  surveillances 
requiring  the  main  turbine  to  be  shut  down. 

Table  3.28  provides  a  summary  of  the  surveillances  recommended  for  performance 
during  a  reduced  power  window.  The  table  also  lists  the  recommended  power  level  for 
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surveillance  performance,  the  average  time  to  perform  the  surveillance  based  on  historical 

records  at  the  candidate  PWR,  and  whether  the  main  turbine  must  be  secured  during 

surveillance  performance. 

Summary  of  Surveillances  Recommended  for 
Performance  during  Reduced  Power  Windows 

Table  3  -  28 


Description 

Power 

Level 

Turbine 

Secured 

Condensate  System 

Condenser  Waterbox  Maintenance 

20-25  hrs 

<20% 

Yes 

EHC  System 

Pressure  Transducer  Calibrations 

6  hrs 

<20% 

Yes 

Emergency  Trip  System  Calibration 

24  hrs 

<20% 

Yes 

EHC  Power  Supply  Calibrations 

16  hrs 

<20% 

Yes 

EHC  Cabinet  Cleaning 

24  hrs 

Yes 

Servo  Strainer  Replacements 

1-2  hrs 

<20% 

Yes 

Feedwater  System 

Steam  and  Feedwater  Flow  Calibrations 

24  hours 

<75% 

No 

Feed  Control  Valve  Indication  and  Stroke 

16  hours 

<15% 

No 

Feedwater  Isolation  Valve  Strokes 

20-30  hours 

<75% 

No 

Feedwater  Isolation  Valve  Fluid  Change 

20  hours 

<75% 

No 

Main  Feed  Pump  Governor  Checks 

5  hours 

<50% 

No 

Generator  Stator  Cooling 

System  Pressure  Switch  Calibrations 

4-6  hrs 

<20% 

Yes 

Lube  Oil 

Main  Turbine  Low  Shaft  Oil  Pressure  Cal 

5  hrs 

<20% 

Yes 

Low  Bearing  Oil  Pressure  Calibration 

5  hrs 

<20% 

Yes 

Main  Steam 

MSIV  Stroke  Checks  (Tech  Spec) 

4-6  hrs 

<75% 

No 

MSIV  Maintenance 

17  hrs 

<75% 

No 

Circ  Water/Service  Water 

CW/SW  Pump  Maintenance 

2-3  hrs 

<92% 

No 

- 

Traveling  Screen  Inspection 

20-24  hrs 

<92% 

No 

3.2.5  Reduced  Power  Surveillance  Window  Economic  Analysis 

Based  on  the  surveillances  listed  in  Table  3.28  a  simplified  economic  analysis  and 

possible  bounding  sequence  for  performance  of  surveillances  in  reduced  power  windows 
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was  developed.  The  bounding  sequence  shown  in  Figure  3-2,  is  one  of  several  scheduling 
options  that  could  be  used  to  complete  the  recommended  reduced  power  windows 
surveillances.  For  instance,  utilities  may  choose  to  perform  the  reduced  power  sequences 
over  the  course  of  several  weekends  when  their  power  demands  are  the  lower  rather  than 
performing  all  the  reduced  power  surveillances  during  one  consecutive  10-11  day  period 
as  shown  in  Figure  3-2.  If  a  utility  chooses  to  perform  the  surveillances  in  short  blocks, 
rather  than  in  one  longer  period,  all  the  surveillances  which  can  be  done  in  parallel  at  that 
given  power  should  still  be  scheduled  for  completion  to  minimize  the  time  required  to  be 
in  a  reduced  power  window.  Additionally,  since  all  the  surveillances  recommended  for 
reduced  power  windows  have  performance  frequencies  of  24  months  or  more,  they  should 
all  be  scheduled  for  completion  during  the  middle  of  the  fuel  cycle  so  that  the  reduced 
power  surveillance  option  must  only  be  exercised  once  during  the  entire  48  months  cycle. 

The  economic  analysis  was  performed  as  follows: 

Assume:  (1)  Replacement  Power  Costs  of  $600K  per  day 

(2)  Ramp  up  and  down  times  one  day  longer  for  shutdown  strategy 

Based  on  Figure  3-2,  the  number  of  days  at  each  power  during  the  10  day  reduced  power 
window  is: 

92%  -  3  days 
75%  -  4  days 
50%  -  1  day 
0%  -  2  days 

Note:  There  is  a  small  fuel  penalty  if  the  reactor  is  kept  on-line  during  turbine 
maintenance.  This  penalty  is  estimated  to  be  less  than  5%  of  the  total  lost  revenue  from 
surveillance  performance  during  a  reduced  power  window. 
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Lost  Revenue  (in  Millions)  During  10  Day  Reduced  Power  Window: 

$0.6/day  *  3  days  *  0.08  =  $0.14 

$0.6/day  *  4  days  *  0.25  =  $0.6 

$0.6/day  *  1  day  *  0.50  =  $0.3 

$0.6/dav  *  2  days  *1.0 _ =  $1.2 

Lost  Revenue  $2.24  Million  (Over  10  day  reduced  power  window) 

Days  Shutdown  for  the  Equivalent  Cost  of  Performing  Maintenance  in  Reduced  Power 
Windows 

2.24  Million/0.6  Million/Day  =  3.7  days 

Less  extra  up  and  down  time  1  day 

Max  Time  Allowed  2.7  days  shutdown 

There  are  several  pros  and  cons  to  performing  surveillances  in  a  reduced  power  window 
as  opposed  to  a  shutting  down  to  perform  the  surveillances. 

Pros 

•  Reduces  thermal  stresses  and  cycles  on  the  plant 

•  Fewer  primary  and  secondary  chemistry  changes 

•  Minimizes  the  amount  of  reliably  running  equipment  that  must  be  secured 

•  Reduced  penalty,  in  general,  for  unexpectedly  long  surveillance  completion  times  at 
power  as  compared  to  shutdown 

•  Allows  immediate  retests  of  equipment  after  surveillance  performance 
Cons 

•  Makes  maintenance  generally  more  difficult  to  perform  because  of  heat/noise/radiation 
levels  while  at  power 

•  Has  unrecoverable  costs  from  burning  fiiel  burned  while  performing  maintenance  at 
self-sustaining  conditions 

•  Results  in  abnormal  plant  lineups  for  several  days  which,  although  allowed,  are  not  as 
familiar  to  the  operators. 
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Example  Reduced  Power  Window  Surveillance  Sequence 

Figure  3-2 


Reduced  Power  Window  Days 


Conclusions 


The  shutdown  strategy  from  a  pure  cost  standpoint  is  effective  only  if  the  maintenance 
window  can  be  completed  in  less  than  2.7  days  which  may  be  difficult.  Utilities  must  also  take 
into  account  the  pros  and  cons  listed  above  when  considering  an  overall  strategy.  Utilities  must 
also  recognize  that  there  is  likely  to  be  an  increased  risk  of  a  plant  trip  from  on-line  performance 
of  these  surveillances  at  reduced  powers.  A  more  detailed  economic  analysis  which  accounts  for 
fuel  costs  in  more  detail,  changes  in  plant  trip  frequency  or  limiting  plant  event  frequency  (LPEF), 
and  the  time  savings  from  on-line  performance  of  the  surveillances  performed  must  be  conducted 
before  a  final  decision  on  which,  if  any,  of  these  surveillances  should  be  performed  in  a  reduced 
power  window.  Any  of  these  surveillances  which  is  not  performed  on-line  must  be  placed  in 
Category  C  and  will  require  further  study  to  remove  the  surveillance  as  a  barrier  to  a  48  month 
fuel  cycle. 
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3.2.6  Summary  of  Investment  Protection  Surveillances 

Table  3.29  summarizes  the  recommended  investment  protection  surveillance  program  at 
the  candidate  PWR,  less  the  electrical  surveillances. 


Summary  of  Recommended  Investment 
Protection  Surveillance  Program 

Table  3  -  29 


System 

Number 

Category 

"  A  •• 

Category 

B 

Category 

c 

NSSS 

— 

— 

— 

— 

Component  Cooling 

21 

8 

4 

9 

Rod  Control 

22 

6 

16 

0 

Chem  Vol  and  Control 

7 

3 

3 

1 

Nuclear  Instruments 

4 

0 

4 

0 

Reactor  Coolant 

84 

39 

37 

8 

RHR/SI 

4 

0 

4 

0 

Miscellaneous  NSSS 

84 

44 

40 

0 

BOP 

— 

— 

— 

— 

Auxiliary  Systems 

83 

35 

41 

7 

Condensate 

17 

14 

0 

3 

Circ  Wtr/Service  Wtr 

19 

14 

5 

0 

Diesel  Generator 

28 

26 

2 

0 

Main  Steam 

39 

21 

12 

6 

Feedwater 

60 

45 

15 

0 

Turbine  Systems 

72 

49 

23 

0 

Miscellaneous  BOP 

102 

93 

9 

0 

Totals 

646 

397* 

215 

34 

*67  at  reduced  power 


The  690  electrical  surveillances  were  not  included  in  table  3-29,  because  as  previously 
explained,  the  precise  performance  mode  for  each  individual  surveillance  was  not  determined. 
Most  of  these  690  surveillances  could  be  performed  on-line  and  thus  are  likely  to  fall  into 
Category  A. 
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3.3  Summary  of  Recommended  PWR  Surveillance  Program 

This  chapter  includes  the  analysis  of  the  entire  surveillance  program  at  an  operating  PWR. 
By  doing  this,  the  chapter  has  met  two  of  the  primary  goals  of  this  project.  First,  it  has 
demonstrated  that  the  regulatory  and  investment  protection  barriers  to  extended  cycle  lengths  can 
be  overcome.  With  the  few  exceptions  discuss  in  detail  in  Chapter  4,  the  vast  majority  of  the 
PWR  surveillances  are  resolvable  to  a  48  month  fuel  cycle.  Table  3-30  summarizes  the  entire 
PWR  surveillance  program,  including  the  investment  protection  690  electrical  surveillances  which 
were  considered  likely  Category  A  surveillances.  Of  the  3108  surveillances  considered  at  the 
candidate  PWR,  only  54  were  considered  potential  barriers  to  an  extended  cycle.  Sixty-seven  of 
the  2673  Category  A  surveillances  are  candidates  for  on-line  performance  during  a  reduced  power 
window.  Second,  this  chapter  in  conjunction  with  the  methodology  presented  in  Chapter  2  has 
demonstrated  a  systematic  surveillance  resolution  procedure  that  utilities  can  use  to  prepare  for 
extended  cycle  lengths.  As  was  previously  stated,  the  recommendations  provided  in  this  chapter 
are  valuable  regardless  of  when  an  extended  cycle  is  adopted.  Implementation  of  the 
recommendations  provided  in  this  chapter  will  significantly  reduce  the  number  of  surveillances 
required  to  be  performed  during  18-24  month  refueling  outages.  This  will  result  in  cost  savings 
from  reduced  outside  contractor  manpower  requirements  as  well  as  the  likelihood  that  the 
refueling  sequence  is  now  likely  to  be  the  critical  path  to  power  restoration. 


Summary  of  Recommended 
PWR  Surveillance  Program 

Table  3  -  30 


■BIH 

Total 

Cat  A 

CatB 

CatC 

1772 

1586 

166 

20 

Investment 

Protection 

1336 

1087 

215 

34 

Totals 

3108 

2673* 

381 

54 

*67  at  reduced  power 
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Chapter  4  -  Category  C  Surveillances 


4.1  Introduction 

All  the  Categow  C  surveillances  identified  in  Chapter  3  are  collected  and  analyzed  in  more 
detail  in  this  chapter.  These  are  the  set  of  surveillances  which  are  currently  identified  as  barriers 
to  attaining  a  48  month  fuel  cycle.  Where  available,  possible  engineering  solutions  to  the 
Category  C  surveillances  are  proposed.  Detailed  engineering  solutions  to  the  complete  set  of 
Category  C  surveillances  identified  in  this  thesis  will  form  the  basis  for  significant  future  work  for 
the  MIT  Extended  Fuel  Cycle  Project  team. 

Hideki  Masui  in  his  thesis  entitled  “Quantitative  Methodology  for  Surveillance  Interval 
Extension  at  Nuclear  Power  Plants”,  May  1996,  provided  a  methodology  to  quantitatively 
rationalize  the  proper  surveillance  interval.  In  it,  he  established  the  economic  and  safety 
requirements  which  are  consistent  with  a  longer  operational  cycle.  The  strategy  and  data 
requirements  for  the  analysis  are  described  in  detail.  This  type  of  methodology  provides  a  method 
for  reexamining  the  Category  C  surveillances  discussed  in  this  chapter. 

4.2  Regulatory  Based  Category  C  Surveillances 

4.2.1  Relief  Valves 

At  the  candidate  PWR  plant  there  are  12  relief  valve  surveillances  involving  38  individual 
relief  valves  which  are  currently  performed  shutdown  at  intervals  less  than  48  months.  These 
relief  valves  cannot  be  tested  on-line,  and  because  of  their  performance  history,  testing  is  unlikely 
to  be  extendible  to  48  months.  These  38  valves  include  the  three  pressurizer  relief  valves  which 
are  Class  1  (primary  pressure  boundary)  relief  valves  and  35  Class  2  (containment  pressure 
boundary)  relief  valves. 

The  Operations  and  Maintenance  of  Nuclear  Power  Plants,  ASME/ANSI  (American 
National  Standards  Institute),  OM-1987,  Chapter  1,  lists  the  requirements  for  in-service 
performance  testing  of  nuclear  power  plant  pressure  relief  devices.  It  requires  that  all  Class  1 
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relief  valves  be  tested  every  five  years  ^d  that  at  least  25%  of  each  type  of  Class  1  valve  be 
tested  every  24  months,  50%  every  36  months,  75%  every  48  months,  and  every  relief  be  tested 
at  least  once  every  60  months.  Relief  types  are  classified  by  their  discharge  diameter  size  in  inches 
and  how  their  design  (i.e.  spring  actuated,  pilot  actuated),  Plants  have  the  option  of  testing  their 
relief  valves  in  place  or  replacing  the  relief  valves  with  bench  tested  spares.  With  the  exception  of 
Main  Steam  Safety  Valves,  which  because  of  their  sheer  size  are  usually  tested  in-place,  most 
utilities  opt  to  use  the  bench  testing  method  to  satisfy  the  code  requirements.  Class  1  relief  valves 
which  are  replaced  with  bench  tested  spares  are  also  required  by  the  code  to  undergo  bench 
testing  after  removal  to  determine  if  the  valves  exceeded  the  stamped  set  pressure  criteria  of  3% 
or  greater  at  the  time  of  replacement.  For  those  Class  1  relief  valves  failing  to  meet  the  set 
pressure  acceptance  criteria,  the  causal  effect  must  be  evaluated  to  determine  the  need  for 
additional  tests'®.  Although  the  code,  as  currently  written,  precludes  extending  the  test  interval 
on  Class  1  relief  valves  to  48  months,  data  at  the  candidate  PWR  received  from  the  company 
which  bench  tests  their  replaced  Class  1  relief  valves  shows  that  the  pressurizer  relief  valves  are 
always  within  specification  when  removed  at  18  month  intervals.  This  indicates  that  the 
requirement  to  test  at  least  25%  of  these  relief  valves  every  24  months  may  be  overly  conservative 
and  should  be  investigated.  However,  because  of  their  safety  importance,  a  more  detailed 
technical  analysis  is  needed  to  justify  extending  the  performance  interval  on  Class  1  relief  valves 
to  48  months.  The  NRC  Generic  Safety  Issues  Branch  (GSIB)  in  the  Office  of  Nuclear 
Regulatory  Research  is  currently  reviewing  failure  modes  and  failure  rates  of  relief  valves  and 
evaluating  the  advantages  and  disadvantages  of  possible  changes  to  the  ASME  code  testing 
requirements." 

As  with  Class  1  relief  valves,  utilities  have  the  option  of  testing  Class  2  relief  valves  in 
place  or  replacing  the  relief  valves  with  bench  tested  spares.  However,  Class  2  relief  valves  are 
only  required  to  be  tested  every  10  years  with  at  least  25%  of  each  type  tested  every  48  months. 
This  would  appear  to  make  Class  2  relief  valves  already  compatible  with  the  48  month  extended 
fuel  cycle.  However,  most  plants  are  currently  testing  these  relief  valves  on  a  more  frequent  basis 


Operations  and  Maintenance  of  Nuclear  Power  Plant,  ASME/ ANSI,  1987,  Chapter  1.  p,  5. 

'*  Cherny,  Frank,  USNRC  Office  of  Research.  Generic  Safety  Issues  Branch,  letter  of  2  February  1996. 
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(18  to  24  months),  and  unlike  the  pressurizer  relief  valves  discussed  in  the  preceding  paragraph, 
the  performance  of  Class  2  relief  valves  has  not  proven  historically  to  be  good  enough  to  allow 
testing  at  intervals  of  48  months.  During  the  most  recent  outage  at  the  candidate  PWR  seven  of 
the  31  Class  2  relief  valves  tested  failed  their  lift  test  check  after  only  18  months  of  operation. 

This  type  of  failure  data  precludes  48  month  testing  intervals  of  the  35  Class  2  relief  valves  which 
are  in  active  systems  and  cannot  be  tested  with  the  reactor  on-line.  Further  analysis  of  industry 
wide  relief  valve  failures,  including  the  valve  type,  valve  size,  system  fluid  conditions,  and 
environmental  conditions  at  the  relief  location  must  be  performed  to  determine  the  principal 
failure  mechanisms  and  allow  recommendations  for  improvement.  Relief  valves  have  universal 
applications  and  are  used  in  many  industries  besides  the  nuclear  industry  so  a  large  amount  of  data 
should  be  available  for  a  detailed  analysis.  Additionally,  if  possible,  trending  of  valve  degradation 
with  time  should  be  considered.  Valves  with  linearly  increasing  set  pressure  variations  must 
eventually  be  corrected  and  will  have  problems  with  extended  fuel  cycles.  Conversely,  relief 
valves  which  exhibit  a  short  term,  large  jump  in  pressure  variation  followed  by  stable  operation 
may  be  satisfactory  for  long  term  operation.  If  the  trend  of  valve  degradation  is  not  well 
understood,  the  wrong  conclusions  may  be  drawn  regarding  a  valve’s  long  term  behavior  and 
compatibility  with  an  extended  fuel  cycle. 


4.2.2  Motor  Operated  Valves 

The  candidate  PWR  has  surveillances  involving  MOV’s  which  cannot  be  performed  on¬ 
line  and  are  unlikely  to  be  extendible  to  48  months.  MOV’s  have  received  widespread  attention  in 
the  nuclear  industry  since  the  issuance  of  Generic  Letter  89-10  (Safety  Related  Motor  Operated 
Valve  Testing  and  Surveillance).  GL  89-10  requested  that  all  MOV’s  in  safety  related  systems 
have  their  design  basis  reverified,  that  the  valves  be  set-up  and  diagnostically  tested,  and  where 
practical  tested  to  their  design  basis  condition.  A  detailed  review  of  all  the  MOV’s  at  the 
candidate  PWR  as  part  of  GL  89-10  requirements  identified  three  basic  categories  of  MOV’ s^^: 


O’Regan,  p.  3. 
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1)  MOV’s  that  are  position-changeable-only  valves.  Position  changeable  valves  are 
valves  which  are  normally  in  their  safety  related  position  and  thus  only  require  the  motor 
to  realign  the  valve  to  it’s  normal  position  following  testing 

2)  MOV’s  with  high  safety  significance  and  high  differential  pressures  across  the  valve 
when  required  to  actuate,  and 

3)  MOV’s  with  high  safety  significance  and  low  differential  pressures  across  the  valve 
when  required  to  actuate. 


Using  the  above  classifications,  the  valve  failure  rate  (directly  related  to  differential 
pressure)  is  combined  with  its  risk  significance  to  determine  the  acceptable  testing  interval  for 
each  valve.  Because  the  failure  rate  for  high  differential  pressure  valves  is  significantly  higher 
than  the  failure  rate  for  low  differential  pressure  valves,  the  failure  rate,  independent  of  the  risk 
significance,  is  the  dominant  factor  in  determining  the  acceptable  testing  intervals. 

Of  the  122  MOV’s  at  the  candidate  PWR,  only  six  of  the  valves  have  high  differential 
pressure  operating  conditions  and  high  risk  significance.  These  six  valves  have  recommended 
performance  intervals  of  36  months.  Of  these  six  MOV’s,  only  three  cannot  be  tested  with  the 
reactor  plant  on-line.  These  three  MOV’s  are  covered  by  a  single  surveillance  and  are  all  valves 
in  the  Safety  Injection  System. .  The  remaining  116  MOV’s  either  have  testing  intervals 
compatible  with  a  48  month  cycle  or  have  been  recommended  for  removal  from  the  surveillance 
program  because  they  are  changeable  position  valves  which  are  already  in  their  required  safety 
position. 


4.2.3  In-Service  Testing 

The  ASME  Boiler  and  Pressure  Vessel  Code,  Section  XI,  “Rules  for  In-Service  Inspection 
of  Nuclear  Power  Plant  Components”,  requires  that  all  safety  related  pumps  and  valves  be  tested 
for  operability  on  a  quarterly  basis.  In  some  cases  it  is  hazardous  or  simply  impossible  to  perform 
the  tests  while  the  plant  is  at  power.  In  general,  surveillances  which  are  hazardous  to  perform  on- 
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line  involve  stand-by  systems  such  as  the  Residual  Heat  Removal  System  or  Safety  Injection. 
Rather  than  shut  down  every  three  months  to  perform  these  operability  tests,  utilities  may  petition 
the  NRC  to  designate  a  surveillance  that  cannot  practically  be  performed  with  the  reactor  core 
installed  as  a  refueling  test  and  defer  the  surveillance  to  refueling  periods.  These  requests  can  be 
augmented  in  the  future  by  risk-based  arguments  Utilities  may  also  opt  to  designate  tests  that  are 
not  as  limiting  as  refueling  tests  but  which  still  cannot  be  performed  with  the  plant  on-line  as  cold 
shutdown  tests.  Cold  shutdown  test  justifications  must  be  documented  and  can  be  audited  by  the 
NRC,  but  do  not  require  prior  approval  of  the  NRC  to  designate  them  as  a  cold  shutdown  test. 
Once  a  surveillance  is  designated  as  either  a  Refueling  or  Cold  Shutdown  Test,  it  does  not  have  to 
be  performed  every  three  months  if  the  plant  is  operating  continuously  over  that  period  of  time.  If 
however,  a  plant  incurs  an  unplanned  outage  after  more  than  three  months  from  the  last  in-service 
testing  period,  the  ASME  code  requires  the  following  rules  be  followed  for  all  surveillances 
designated  as  Cold  Shutdown  Tests: 

•  Testing  is  to  commence  as  soon  as  practical  when  the  Cold  Shutdown  condition  is 
achieved,  but  no  later  than  48  hours  after  shutdown,  and  continue  until  all  testing  is 
complete  or  the  plant  is  ready  to  return  to  power. 

•  Completion  of  all  testing  is  not  a  prerequisite  to  return  to  power.  Any  testing  not 
completed  during  one  cold  shutdown  should  be  performed  during  any  subsequent  cold 
shutdown  starting  with  those  tests  not  previously  completed  done  first. 

•  Testing  need  not  be  performed  more  often  than  once  every  3  months. 

•  In  the  case  of  an  extended  cold  shutdown,  the  testing  need  not  be  started  within  the  48- 
hour  limitation.  However,  in  extended  cold  shutdowns,  all  Cold  Shutdown  Testing  must 
be  completed  prior  to  returning  to  power. 

If  a  plant  operates  uninterrupted  for  an  entire  cycle,  cold  shutdown  testing  is  only 
performed  during  refueling  outages.  Since  the  longest  operating  cycles  in  the  United  States  are 
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approximately  24  months,  the  maximum  current  interval  on  a  Cold  Shutdown  Test  is  24  months. 
The  question  that  then  arises  is  is  there  an  upper  limit  on  the  allowable  length  between  cold 
shutdown  testing'’  The  ASME  code  does  not  address  the  question  of  how  long  is  long  enough, 
and  opinions  vary  as  to  the  likelihood  of  48  month  surveillance  intervals  being  acceptable. 
Conversations  with  regulatory  personnel  and  system  engineers  at  the  candidate  PWR  indicated 
that  there  is  sufficient  performance  data  available  to  make  the  case  for  interval  extension  on  most 
of  the  components  covered  by  the  code. 

If  the  interval  extension  cannot  be  technically  justified,  most  of  the  designated  cold 
shutdown  surveillances  are  relatively  simple  to  perform  and  are  excellent  candidates  for  a 
surveillance  performance  hotlist.  This  hotlist  would  track  those  surveillances  which  should  be 
prepped  and  ready  to  be  performed  immediately  whenever  the  plant  is  shutdown  for  any  reason. 

To  further  solve  the  in-service  testing  interval  question  new  technologies  should  be 
investigated  to  provide  a  means  of  justifying  surveillance  performance  intervals  out  to  48  months. 
Application  of  innovative  monitoring  technologies  could  provide  enough  on-line  diagnostic 
information  on  the  various  pumps  and  valves  to  ensure  operability  upon  demand.  This  would 
ultimately  remedy  the  burden  of  maintaining  some  or  all  of  the  Cold  Shutdown  Operability  Tests 
on  the  surveillance  performance  hotlist. 


4,2.4  Engineered  Safety  Features 

There  are  six  separate  surveillances  involving  three  similar  Engineered  Safety  Feature 
Actuation  System  (ESFAS)  tests  (two  trains  each)  performed  at  the  candidate  PWR  which  cannot 
be  performed  on-line,  and  which  are  not  likely  to  be  extendible  to  48  months.  These  are 
integrated  tests  which  involve  sensors,  signal  processing,  and  valve  and  pump  actuation.  They 
cannot  be  performed  on-line  because  of  the  risk  of  injecting  cold  water  into  an  operating  reactor 
which  will  result  in  a  large  and  potentially  dangerous  power  excursion.  Each  test  is  described  in 
more  detail  below. 
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4.2.4.1  Diesel  Generator  Operability  and  Engineered  Safeguards  Pump  and  Valve 
Response  Time  Testing 

There  are  two  integrated  diesel  generator  operability  and  engineered  safeguards  pump  and 
valve  response  time  tests  (one  for  each  train)  currently  performed  with  the  plant  shutdown  at  1 8 
month  intervals  which  cannot  be  performed  on  line,  and  which  are  unlikely  to  be  extendible  to  48 
months.  It  may  be  possible  to  devise  a  safe  test  which  would  test  the  integrated  features  of  all  the 
safety  systems  involved  with  the  exception  of  actually  putting  water  into  the  core  with  the  reactor 
critical.  However,  because  this  test  is  central  to  proving  that  cooling  water  can  be  delivered  in 
sufficient  quantities  to  prevent  damage  to  the  core  and  the  containment  in  the  event  of  a  major 
Loss  of  Coolant  Accident  (LOCA),  non-technical  factors  must  also  be  considered  when 
contemplating  extending  to  48  months  those  portions  of  this  test  that  provide  system  proof  of 
flow  to  the  reactor  vessel  and  containment.  This  surveillance  should  be  studied  further. 


4.2.4.2  Actuation  of  Auto  Safety  Injection,  Containment  Building  Spray,  and  Control 
Building  Air  systems 

There  are  two  surveillances  in  this  category  currently  performed  while  shutdown  at  18 
month  intervals  which  cannot  be  performed  on  line,  and  which  are  unlikely  because  of  safety 
concerns  to  be  extendible  to  48  months.  The  two  surveillances  are  identical  (one  for  each  train) 
and  verify  that  the  automatic  safety  injection,  containment  building  spray,  and  control  building  air 
systems  actuate  within  allowable  time  limits  upon  receipt  of  a  test  signal.  The  tests  also  verify 
that  the  manual  alarms  for  these  systems  function  correctly.  These  tests  are  typically  performed  in 
conjunction  with  the  Diesel  Generator  Operability  and  Engineered  Safeguards  Pump  and  Valve 
Response  Time  Testing  detailed  in  section  4.2.4. 1.  While  it  may  be  possible  to  design  an 
integrated  test  which  measures  the  response  time  of  the  instrumentation  without  any  valve 
actuation,  the  test  setup  is  likely  to  be  very  complex  and  place  the  plant  in  a  very  unstable 
condition  during  the  testing  because  of  the  removal  of  one  complete  ESF  train  for  an  extended 
period  of  time.  Further  study  of  these  integrated  ESF  tests  is  needed. 
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4.2.4.3  Emergency  Core  Cooling  Systems  Automatic  Actuation  Test 

There  are  two  identical  surveillances,  one  for  each  ECCS  train,  currently  performed  off¬ 
line  which  cannot  be  performed  on  line,  and  which  are  unlikely  to  be  extendible  to  48  months. 
These  tests  are  typically  performed  in  conjunction  with  the  other  ESFAS  integrated  test  included 
in  sections  4.2.4, 1  and  4. 2. 4. 2.  This  surveillance  tests  that  various  ECCS  systems  will  realign 
within  specified  time  limits  upon  receipt  of  a  SI  signal  including  the  initiation  of  feedwater 
isolation,  diesel  generator  start,  containment  isolation,  containment  ventilation  system  isolation, 
and  primary  component  cooling  water  system  (PCC)  realignment.  While  all  but  two  of  the  motor 
operated  valves  in  the  test  are  recommended  for  testing  at  intervals  greater  than  48  months,  and 
other  individual  parts  of  the  test  can  probably  be  conducted  on-line,  a  method  to  test  the 
integrated  nature  of  the  system  on-line  requires  further  investigation. 


4.2.5  Steam  Generator  Eddy  Current  Testing 

Steam  generator  eddy  current  testing  is  currently  performed  shutdown  at  18-24  month 
intervals.  It  cannot  be  performed  on  line,  and  is  unlikely  to  be  extendible  to  48  months  because  of 
previous  experience  within  the  nuclear  industry  with  tube  failures  due  to  stress  corrosion  cracking 
and  aging.  The  current  NRC  inspection  guidelines  for  steam  generators  allow  for  periods 
between  steam  generator  eddy  current  testing  of  up  to  40  months.  This  interval  is  allowed  only 
after  two  previous  successful  inspections  at  shorter  intervals.  However,  because  of  the  difficulty 
planning  for  a  constantly  changing  inspection  interval,  most  PWR’s  opt  to  inspect  all  their  steam 
generators  every  refueling  outage  regardless  of  the  maximum  allowable  inspection  interval.  Thus, 
inspection  intervals  much  greater  than  24  months  which  might  provide  some  data  as  to  the  long 
term  performance  of  steam  generator  tubes  are  rare.  Although  many  of  the  steam  generator  tube 
corrosion  mechanisms  have  been  virtually  eliminated  by  proper  temperature  and  chemistry 
control,  the  industry  trend  is  towards  more  frequent  inspections  as  the  steam  generators  age. 

Many  utilities  are  now  replacing  their  Inconel  600  steam  generators  with  Inconel  690 
steam  generators  which  are  supposedly  less  susceptible  to  stress  corrosion  cracking,  one  of  the 
principal  steam  generator  failure  mechanism.  However,  these  claims  are  based  upon  laboratory 
testing  and  have  not  been  substantiated  by  inspection  results  from  actual  steam  generators.  An 
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extensive  database  of  inspection  results  for  Inconel  690  steam  generators  must  be  collected 
industry  wide  before  the  technical  case  can  be  made  for  increasing  the  interval  between  eddy 
current  inspections  to  as  much  as  48  months.  Further  research  is  required  in  this  area,  including 
the  possible  use  of  state-of-the-art  on-line  monitoring  tools.  A  program  is  underway  at  MIT 
headed  by  Professor  Ronald  Ballinger  to  develop  a  tool  which  would  provide  on-line  tube 
integrity  information. 

The  candidate  PWR  in  preparation  for  transitioning  to  a  48  month  fuel  cycle  recently 
completed  a  draft  of  a  technical  request  to  the  NRC  to  extend  the  interval  between  Steam 
Generator  tube  inspections  to  50  months.  The  technical  evaluation  concluded  that  tube 
degradation  over  the  course  of  50  months  experienced  in  the  type  of  steam  generators  used  at  the 
candidate  PWR  would  not  reduce  the  margins  of  safety  required  by  NRC  Regulatory  Guide  1.121 
“Bases  for  Plugging  Degraded  PWR  Steam  Generator  Tubes”,  August,  1976.  The  candidate 
PWR  uses  four  Westinghouse  Model  F  with  5626  Thermally  Treated,  Inconel  600  U-tubes  (SB- 
163),  hydraulically  expanded  into  the  tubesheet  at  each  end.  The  tube  bundle  is  supported  by 
“V”-shaped  Anti-Vibration  Bars  in  the  U-tube  bend  region  and  eight  stainless  steel  Tube  Support 
Plates.  If  approved  by  the  NRC,  it  would  eliminate  eddy  current  testing  as  a  barrier  to  an 
extended  fuel  cycle  for  those  plants  with  excellent  operating  history  and  newer  design  steam 
generators.  To  date  however,  the  NRC  has  not  approved  any  extensions  to  50  months. 
Therefore,  eddy  current  testing  is  likely  to  remain  a  barrier  for  the  majority  of  PWR  plants. 


4.3  Investment  Protection  Category  C  Surveillances 

4.3.1  Relief  Valves 

At  the  candidate  PWR  plant  there  are  23  relief  valve  surveillances  currently  performed 
shutdown  at  intervals  less  than  48  months.  These  reliefs  cannot  be  tested  on-line,  and  because  of 
their  performance  history,  testing  is  unlikely  to  be  extendible  to  48  months.  All  the  investment 
protection  relief  valves  are  Class  2  relief  valves  (containment  boundary  valves).  The  investment 
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protection  relief  valves  are  the  same  design  as  the  regulatory  based  relief  valves.  For  a  more 
detailed  discussion  of  the  basis  for  classifying  relief  valves  in  general  as  Category  C  surveillances 
refer  to  section  4.2.1 


4.3.2  Condenser  Waterbox  Maintenance 

The  Main  Condenser  is  the  primary  heat  sink  for  the  power  plant.  The  ability  to 
effectively  transfer  heat  to  the  condenser  is  vital  to  the  efficient  performance  of  the  entire  plant.  If 
the  main  condenser  heat  transfer  capability  is  degraded,  either  the  plant  must  be  operated  at 
reduced  load  or  risk  overheating  and  potentially  severe  damage  to  the  condenser,  including 
overpressurization  and  rupture. 

The  primary  degradation  mechanism  of  the  heat  transfer  capability  of  the  condenser  is  the 
clogging  of  the  condenser  inlet  tube  sheets  and  tubes  from  either  debris  or  marine  growth.  Since 
most  condensers  use  brackish  water  as  the  cooling  medium  (seawater,  river/lake  water),  it  is 
virtually  impossible  to  totally  prevent  the  buildup  of  debris  or  marine  growth  in  the  condenser. 
While  the  onset  of  reduced  heat  transfer  capability  can  be  delayed  by  the  use  of  suction  screens  on 
the  piping  to  the  service  water  pumps,  the  only  proven  way  to  restore  or  maintain  the  condenser’s 
heat  transfer  capability  is  by  opening  the  condenser  and  manually  cleaning  the  tube  sheet  faces  and 
lancing  the  tubes  themselves  or  on-line  through  the  use  of  chemicals  or  abrasion  balls.  Even 
though  the  main  condenser  at  the  candidate  PWR  has  three  individual  tube  bundles  which  make 
up  the  main  condenser  they  are  not  isolable  for  inspection  with  the  main  turbine  on  the  line. 
Therefore,  any  opening  of  the  condenser  waterbox  for  inspection  and  cleaning  will  require  the 
turbine  and  all  steam  loads  to  the  condenser  to  be  secured. 

At  the  candidate  PWR,  the  condenser  waterboxes  are  currently  cleaned  once  every  1 8 
months.  Maintenance  records  and  discussions  with  system  engineers  indicate  that  the  condensers 
require  a  thorough  cleaning  at  the  18  month  intervals. 

The  heat  transfer  performance  of  the  main  condenser  can  be  continuously  calculated  by 
monitoring  the  service  water  temperature  changes  across  the  condenser  and  the  main  turbine 
vacuum.  In  this  way,  plant  engineers  can  determine  when  the  tube  sheets  are  beginning  to  clog  to 
such  an  extent  that  they  must  be  cleaned  to  continue  full  power  operations.  At  what  point  this 
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occurs  has  not  yet  been  determined,  and  this  point  may  vary  depending  on  the  season  or  makeup 
of  the  service  water  source.  Even  though  the  candidate  PWR  condensers  currently  receive  a 
thorough  cleaning  at  1 8  month  intervals,  the  condensers  have  not  yet  reached  the  point  where  a 
degradation  in  heat  transfer  capability  has  occurred,  indicating  that  the  performance  interval  could 
be  safely  extended  past  18  months  albeit  not  necessarily  to  48  months. 

One  potential  solution  which  may  extend  the  interval  between  required  condenser 
cleanings  would  be  installation  of  piping  which  would  allow  the  individual  sections  of  the 
condensers  to  be  back  flushed  one  at  a  time.  This  type  of  flush  could  be  performed  with  the 
turbine  on-line,  and  although  it  would  not  eliminate  all  the  debris  or  marine  growth  buildup  in  the 
condenser,  it  might  eliminate  enough  so  that  the  interval  between  waterbox  inspections  could  be 
extended  to  48  months. 

The  condenser  waterbox  maintenance  may  also  be  a  candidate  for  performance  during  a 
reduced  power  window  with  the  turbine  removed  from  service.  If  the  inspection  and  cleaning  can 
nominally  be  performed  in  two  to  three  days  it  should  be  considered  for  on-line  performance.  The 
economic  analysis  of  Chapter  3,  section  3.6.5,  considered  the  impact  of  on-line  performance  of 
condenser  waterbox  maintenance  assuming  a  two  to  three  day  performance  window  as  shown  in 
figure  3-2. 


4.3.3  Reactor  Coolant  Pumps 

There  are  eight  reactor  coolant  pump  surveillances  which  cannot  be  performed  on-line 
because  the  pumps  are  not  accessible  at  power,  and  whose  past  performance  history  suggests  that 
they  cannot  be  safely  extended  to  48  months.  All  eight  surveillances  deal  with  the  reactor  coolant 
pump  lube  oil  system. 

The  check  of  the  four  reactor  coolant  pump  oil  level  hi/lo  alarm  must  be  performed 
shutdown  because  the  oil  system  for  the  reactor  coolant  pumps  are  not  accessible  at  power  and 
the  pumps  are  required  to  be  shutdown  to  check  the  alarms.  The  check  is  performed  by  varying 
the  lube  oil  level  in  the  pump  oil  reservoir  with  the  reactor  coolant  pump  secured  to  check  the 
operation  of  the  high  and  low  level  switches. 
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One  possible  solution  for  this  surveillance  would  be  to  design  the  pump  oil  reservoir  so 
that  it  would  be  accessible  with  the  plant  at  power.  The  oil  level  switches  could  then  be  replaced 
with  bench  tested  spares  versus  varying  the  actual  oil  level  in  the  reservoir  which  would  not  be 
prudent  with  the  reactor  coolant  pump  running.  In  this  way,  the  switches  could  be  checked  on  a 
more  frequent  basis  if  necessary,  and  only  then  tested  in  place  by  varying  the  lube  oil  reservoir 
level  at  48  month  intervals  with  the  pump  secured.  Additionally,  if  the  lube  oil  reservoir  for  the 
pump  could  be  made  accessible  with  the  plant  at  power,  a  sight  glass  could  be  installed  to  allow 
manual  checks  of  the  lube  oil  level  when  level  switches  were  removed  for  replacement. 

The  lube  oil  in  the  reactor  coolant  pumps  is  sampled  every  1 8  months  and  replaced  if 
necessary.  Conversations  with  the  reactor  coolant  pump  system  engineer  indicated  that  the  lube 
oil  often  requires  replacement  at  18  month  intervals.  If  an  accessible  oil  reservoir  described  in  the 
paragraph  above  is  installed,  lube  oil  sampling  could  be  accomplished  on-line  to  provide  a  means 
for  determining,  on  a  performance  basis,  when  the  lube  oil  in  the  reactor  coolant  pumps  required 
replacement.  Additionally,  consideration  should  be  give  to  installing  an  on-line  purification 
system  similar  to  those  used  for  most  main  turbines.  The  purification  system  would  allow  the 
pumps  to  run  for  extended  periods  of  time  without  having  to  change  the  oil.  Additional  oil  could 
be  added  to  the  pump  oil  reservoir  with  the  pump  running  if  required. 

Damage  to  a  reactor  coolant  pump  would  certainly  qualify  as  one  of  the  major  limiting 
plant  events.  Therefore,  until  changes  are  made  which  would  allow  on-line  purification  and 
sampling,  shutting  down  to  change  the  reactor  coolant  pump  lube  oil  when  required,  even  if  it  is 
inside  of  48  months  is  the  most  prudent  choice. 


4.4  Summary  of  Category  C  Surveillances 

Table  4-1  summarizes  the  PWR  Category  C  surveillances.  Additionally,  based  on  plant 
historical  records,  estimates  of  the  time  required  to  perform  each  surveillance  is  included. 
Because  the  total  time  for  the  plant  to  be  offline  would  include  about  a  day  to  establish  the  plant 
conditions  necessary  to  commence  the  surveillances  and  a  day  to  bring  the  plant  back  on-line 
following  the  completion  of  all  the  surveillances,  the  total  outage  time  is  likely  to  be 
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approximately  two  weeks  based  on  the  time  to  complete  the  longest  surveillance  (Eddy  Current 
Testing). 


Summary  of  Category  C  Surveillances 
Table  4  - 1 


Surveillance  Category 

Investment  Protection  or 
Regulatory  Based 

Estimated  Time 

Relief  Valve  Testing 

Investment/Regulatory 

4  days 

MOV  Testing 

Regulatory 

1  day 

Condenser  Waterbox 

Investment 

2  days 

ESFAS 

Regulatory 

1 0  days 

S/G  Eddy  Current  Testing 

Regulatory 

12  days 
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Chapter  5  -  Surveillance  Interval  Extension  Justifications 


5.1.  Introduction 

This  chapter  presents  an  example  of  a  performance  interval  extension  justification 
conducted  as  part  of  an  actual  24  month  fuel  cycle  extension  program  at  the  candidate  PWR.  A 
detailed  procedure  for  use  in  drafting  similar  interval  extension  requests  to  the  NRC  is  provided  in 
Appendix  A.  This  procedure,  which  I  drafted,  is  used  as  the  basis  for  drafting  all  24  month  fuel 
cycle  interval  extension  requests  at  the  candidate  PWR.  The  surveillance  interval  extension 
example  provided  here  is  intended  to  provide  a  general  guide  to  utilities  for  use  in  developing 
justifications  for  performance  interval  extension.  The  example  also  demonstrates  the  type  of 
effort  required  to  perform  a  complete  48  month  fuel  cycle  surveillance  resolution  project.  For  this 
thesis,  complete  justification  of  all  candidate  surveillances  was  a  prohibitively  large  task.  Because 
actual  surveillance  resolutions  will  vary  somewhat  from  plant  to  plant,  a  complete  surveillance 
justification  program  is  left  to  the  individual  utility. 


5.2.  Performance  Interval  Extension  Technical  Evaluation 

The  following  technical  evaluation  for  surveillance  interval  extension  was  written  for 
submission  to  the  licensing  department  at  the  candidate  PWR  as  part  of  an  actual  24  month  fuel 
cycle  extension  program.  The  significant  hazards  evaluation  presented  in  Section  IV  of  the 
evaluation  will  form  the  basis  for  the  formal  request  for  interval  extension  to  the  NRC.  Although 
written  for  an  extension  from  1 8  to  24  months,  the  format  and  methodology  used  in  this  technical 
evaluation  are  applicable  to  any  cycle  length.  A  detailed  procedure  for  completing  licensing  based 
technical  evaluations  is  enclosed  as  Appendix  A. 
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TECHNICAL  EVALUATION  NUMBER  5F 
FOR  CHANGE  TO 

TECHNICAL  SPECIFICATION  NO.  4.7.3.b 
PRIMARY  COMPONENT  COOLING  WATER  SYSTEM 
AUTOMATIC  VALVE  SURVEILLANCE  INTERVAL 

SECTION  I  -  TECHNICAL  EVALUATION  CONCLUSION 

Technical  Specification  (T/S)  Surveillance  Number  4.7.3.b  which  is  currently  performed  once  per 
18  months,  can  be  performed  at  surveillance  intervals  of  up  to  30  months  (24  months  +  25%). 
The  effect  on  plant  safety  is  insignificant,  Historical  preventative  and  corrective  maintenance 
records,  surveillance  data,  other  surveillances  performed  on  system  components,  and  a  failure 
mode  analysis  validate  this  conclusion..  Additionally,  the  performance  of  the  surveillance  at  the 
bounding  surveillance  interval  limit  (30  months)  will  not  invalidate  any  assumption  in  the  plant 
licensing  basis. 

SECTION  H  -  DESCRIPTION  OF  CHANGE 


The  PCC  automatic  valves  servicing  safety  related  equipment  are  demonstrated  operable  every  18 
months  by  verifying  that  each  automatic  valve  servicing  safety-related  equipment  actuates  to  its 
correct  position  on  its  associated  Engineered  Safety  Feature  (ESF)  actuation  signal  in  accordance 
with  T/S  No.  4.7.3.b.  This  change  involves  increasing  the  surveillance  interval  to  30  months  (24 
months  +  25%)  and  is  associated  with  plant  changes  to  support  24  month  fuel  cycle 
implementation.  The  valves  tested  by  T/S  4.7.3.b  are  listed  in  Attachment  1. 

SECTION  HA  -  OPEN  ITEMS  DESCRIPTION  (Remove  when  resolved) 

There  are  approximately  120  MOV’s  throughout  the  plant.  There  are  two  off-line  MOV 
preventative  maintenance  items  performed  at  intervals  of  36  months  or  more  (multiples  of  an  18 
month  refueling  interval)  which  will  be  impacted  by  the  move  to  a  24  month  fuel  cycle.  These 
include: 

(1)  Limitorque  Actuator  Inspections  (RF02) 

(2)  EQ  maintenance  for  Limitorque  operated  valves  (RF03) 

These  surveillances  are  summarized  in  Table  1  with  their  current  frequency  and  the 
associated  performance  interval  in  months  for  both  a  1 8  month  and  24  month  cycle  length.  Based 
on  conversations  with  the  MOV  system  engineer,  a  new  recommended  performance  frequency  is 
included  which  is  closest  to  the  performance  interval  (in  months)  the  system  engineer 
recommended  for  each  surveillance.  Because  the  current  practice  is  to  perform  each  surveillance 
on  only  a  portion  of  the  approximately  120  MOV’s  during  each  outage  (for  example,  half  for 
RF02  items,  one  third  for  RF03  items,  etc.)  there  will  be  some  impact  on  the  work  scope  required 
during  a  24  month  cycle  outage  which  may  either  increase  the  outage  length  or  require  more 
manpower  to  complete  with  no  change  in  length.  These  factors  will  have  to  be  evaluated  in  the 
context  of  the  whole  24  month  fuel  cycle  project.  One  option  which  may  help  mitigate  these 
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factors  is  the  trend  towards  increased  on-line  performance  of  surveillance  items.  The  MOV 
system  engineer  indicated  they  are  moving  in  that  direction. 


Current  Interval  for 
Various  Cycle  Lengths 

PM  Description 

Current 

Frequency 

IS  Month 

iiliiiiiiiii 

(+25%) 

24  Month 
Cycle 

Blillll 

Recommended  New 
Frequency  for  24  Mo 

Limitorque  Actuator 
Inspection 

RF02 

36-44  Mos 

48-60  Mos 

RFOl  (24-30  Mos) 

EQ  Maintenance  for 
Limitorque  Valves 

RF03 

54-66  Mos 

72-90  Mos 

RF02  (48-60  Mos) 

Table  1 


SECTION  ni  -  EVALUATION  OF  CHANGE 


The  PCC  system  supplies  cooling  water  for  the  following  components  which  are  needed  for  plant 
operation  or  to  satisfy  one  or  more  basic  safety  functions:  i.e.,  to  maintain  core  hat  removal,  to 
maintain  coolant  inventory,  etc.; 

Containment  Spray  (CBS)  pumps 
Containment  Spray  Heat  Exchangers 
Residual  Heat  Removal  (RHR)  Pumps 
RHR  Heat  Exchangers 
Safety  Injection  (SI)  Pumps 
Centrifugal  Charging  Pumps 
Containment  Enclosure  Coolers 

Reactor  Coolant  Pump  (RCP)  Thermal  Barrier  Cooling  Heat  Exchangers 

The  PCC  system  consists  of  the  RCP  Thermal  Barrier  (RCPTB)  loop  and  two  independent  flow 
loops,  A  and  B,  each  of  which  supplies  component  cooling  water  to  one  of  the  redundant 
components  performing  engineered  safeguard  functions  and  to  the  RCPTB  loop  and  to  various 
nonsafeguard  components.  One  of  the  two  100  percent  (accident  conditions)  PCC  pumps 
connected  in  parallel  supplies  flow  to  each  loop.  One  PCC  heat  exchanger  in  loop  A  and  one  in 
loop  B  transfers  the  heat  loads  from  the  RCPTB  loop  and  plant  components  to  the  Service  Water 
System. 

A  single  PCC  loop  A  or  B  pump  providing  flow  to  the  PCC  heat  exchanger  in  its  loop  is  capable 
of  removing  the  total  heat  during  the  recirculation  phase  following  a  loss-of-coolant  accident 
occurring  simultaneously  with  a  loss  of  offsite  electrical  power. 
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The  following  factors  related  to  PCC  automatic  valve  performance  over  the  last  three  operating 
cycles  were  considered  in  evaluating  the  extension  of  the  surveillance  frequency  to  a  maximum  of 
30  months: 

•  Potential  System  Failure  Modes 

•  Surveillance  results 

•  Corrective  maintenance  frequency  and  type 

•  Preventative  maintenance  records 

•  System  Engineer  consultation 

Potential  System  Failure  Modes.  Technical  Specification  Surveillance  Number  4.7.3.b  tests  that 
the  PCC  valves  automatically  actuate  upon  receiving  an  Engineered  Safety  Feature  signal. 

Potential  modes  of  failure  for  this  surveillance  such  as  valve,  sensor,  or  signal  path  failure  do  not 
have  time  dependent  failures  that  are  so  short  that  they  would  be  expected  to  occur  inside  of  30 
months,  or  individual  failures  can  be  identified  during  plant  operation  through  other  surveillances 
which  are  performed  on-line  on  a  more  frequent  basis.  The  following  provides  a  discussion  of 
these  items. 

Valve  Failure:  Valves  are  tested  on-line  on  a  more  frequent  basis  to  confirm  their  operability  or 
do  not  have  failure  modes  that  would  be  expected  to  occur  inside  of  30  months. 

The  four  Motor  Operated  Valves  (MOV)  tested  by  T/S  surveillance  number  4.7.3. b  are  stroked 
monthly  to  check  flow  through  the  RHR  heat  exchangers.  They  are  also  time  stroked  quarterly. 
Periodic  stroking  ensures  electrical  power  is  available  to  the  valve  and  identifies  any  valve 
mechanical  problems.  A  review  of  the  performance  and  trend  of  the  quarterly  stroke  times  of  the 
MOV’s  showed  no  time  dependent  degradation  in  stroke  times  and  continued  proper  mechanical 
performance  thus  supporting  an  increase  in  the  T/S  surveillance  interval  to  at  least  30  months. 
Periodic  inspection  and  lubrication  of  these  valves  is  performed  at  36  month  intervals  and  will  not 
be  impacted  by  a  30  month  maximum  test  interval. 

Piston  operated  valves  CC-V32  and  CC-V445  (Spent  Fuel  Pool  Heat  Exchanger  Isolation)  tested 
by  T/S  surveillance  number  4.7.3.b  are  time  stroked  quarterly  to  confirm  their  operability.  The 
quarterly  time  stroking  ensures  electrical  power  is  available  to  the  valve  and  identifies  any  valve 
mechanical  problems.  A  review  of  the  performance  and  trend  of  valve  stroke  times  of  these 
piston  operated  valves  showed  no  time  dependent  degradation  in  stroke  times  and  continued 
proper  mechanical  performance  and  thus  supports  an  increase  in  the  T/S  surveillance  interval  to  at 
least  30  months. 

The  remaining  13  valves  are  all  piston  operated  valves  and  are  only  mechanically  stroked  as  part 
of  T/S  surveillance  number  4.7.3.b.  A  detailed  review  of  historical  stroke  times  of  these  valves 
was  conducted  to  confirm  that  electrical  power  was  always  available  to  the  valves  and  that  valve 
stroke  times  were  not  time  dependent  on  the  interval  of  concern.  Valve  stroke  times  were 
reviewed  following  the  initial  12  month  refueling  cycle  and  compared  to  valve  stroke  times 
following  the  two  18  month  refueling  cycles.  Valve  stroke  times  were  completely  independent  of 
the  interval  between  stroking.  Additionally,  all  of  the  stroke  times  were  significantly  less  than  the 
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design  basis  maximum  allowed  stroke  times.  Environmental  conditions  in  the  vicinity  of  these 
valves  were  also  deemed  to  have  a  minimal  impact  on  valve  performance  from  the  current  test 
interval  out  to  the  maximum  test  interval  of  30  months.  Therefore,  although  these  13  valves  are 
not  tested  by  any  other  surveillance  in  the  interim  between  T/S  surveillance  4.7.3.b  performance, 
historical  test  data,  environmental  conditions,  and  no  time  dependent  failure  modes  inside  of  30 
months  support  safe  extension  of  the  T/S  surveillance  interval  to  a  maximum  of  30  months  on 
these  valves. 

Signal  Path  Failure:  The  signal  path  from  the  instrument  to  the  valves  is  tested  quarterly.  The 
quarterly  signal  path  tests  confirm  that  the  signal  path  can  safely  support  the  T/S  surveillance 
interval  extension  to  a  maximum  of  30  months. 

Transmitter  failure:  The  transmitters  are  calibrated  at  refueling  intervals.  Redundant  transmitter 
channels  feed  each  signal  path.  A  transmitter  failure  inside  of  its  calibration  interval  would  be 
identified  by  operating  logs  review  and  by  comparison  to  the  other  redundant  instrument  channels. 

The  potential  failure  mode  review  shows  that,  with  the  exception  of  the  13  piston  operated  valves, 
the  entire  system  is  tested  on  a  significantly  more  frequent  basis  than  T/S  4.7.3.b.  Historical 
operating  data  on  the  13  piston  operated  valves  indicates  with  a  high  degree  of  confidence  that 
these  valves  will  perform  their  intended  functions  at  intervals  of  30  months.  In  combination,  this 
information  shows  that  there  is  an  insignificant  increase  in  risk  by  extending  the  surveillance 
interval  to  a  maximum  of  30  months. 

Surveillance  Results;  Past  surveillance  test  results  were  reviewed.  The  surveillance  is  verified 
by  an  integrated  system  test  performed  by  procedure  number  EXl  804.024  Revision  3  (Reference 
1).  The  system  design  features  worked  correctly  on  all  past  surveillance  tests  (Attachment  2). 
Therefore,  past  surveillance  tests  support  increasing  the  surveillance  interval  to  30  months  (24 
months  +25%). 

Corrective  Maintenance  Frequency  and  Type:  PCC  system  corrective  maintenance  records 
were  reviewed  (Attachment  3).  54  of  the  80  items  were  identified  and  corrected  prior  to  initial 
plant  operations  at  100%  power.  An  additional  10  items  were  design  enhancements  to  the 
system,  leaving  only  1 6  system  corrective  maintenance  items  during  the  four  operating  cycles. 
During  the  plant’s  operating  history  there  were  no  corrective  maintenance  items  performed  whose 
failures  were  time  dependent.  Additionally,  none  of  the  items  for  which  corrective  maintenance 
was  performed  would  have  prevented  the  valves  from  performing  their  design  safety  function 
upon  receipt  of  an  ESF  signal.  Therefore,  corrective  maintenance  records  support  surveillance 
extension  to  30  months  (24  months  +25%). 

Preventative  Maintenance  Records:  Review  of  the  PCC  system  regularly  scheduled 
preventative  maintenance  (PM)  activities  with  a  refueling  or  1 8  month  interval  has  concluded  that 
there  are  no  PM’s  with  this  interval.  All  off-line  maintenance  items  have  performance  intervals,  in 
years  or  refueling  multiples,  which  are  greater  than  30  months  (Attachment  4).  Therefore,  an 
increase  in  the  T/S  surveillance  interval  to  a  maximum  of  30  months  will  not  impact  regularly 
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scheduled  PM’s  on  the  PCC  system,  assuming  that  all  the  open  items  listed  in  section  II A  are 
resolved. 


System  En2ineer  Consultation:  The  PWR  PCC  System  Engineer  and  the  PWR  Motor 
Operated  Valve  Engineer  were  consulted  to  verify  that  the  conclusions  reached  in  this  evaluation 
are  consistent  with  their  knowledge  base.  The  system  engineers  confirmed  that  the  PCC  system 
performance  history  supports  extension  of  the  surveillance  interval  to  30  months. 


SECTION  IV  -SIGNIFICANT  HAZARDS  EVALUATION 

In  accordance  with  10CFR50.92,  the  utility  has  reviewed  the  proposed  changes  and  has 
concluded  that  they  do  not  involve  a  significant  hazards  consideration  (SHC).  The  basis  for  this 
conclusion  is  that  the  three  criteria  of  10CFR50.92(c)  are  not  compromised.  The  proposed 
changes  do  not  involve  an  SHC  because  the  changes  would  not; 

1.  Involve  a  significant  increase  in  the  probability  or  consequences  of  an  accident  previously 
evaluated. 

The  proposed  change  to  Surveillance  Requirement  4.7.3.b  of  the  PWR’s  Technical  Specifications 
extends  the  interval  for  verifying  that  each  automatic  valve  servicing  safety-related  equipment 
actuates  to  its  correct  position  on  its  associated  Engineered  Safety  Features  (ESF)  actuation 
signal.  The  proposal  would  extend  the  interval  from  at  least  once  per  18  months/reflieling  to  at 
least  once  each  refueling  interval  (nominal  24-months  +  25%  =  30  months). 

The  proposed  change  does  not  alter  the  intent  or  method  by  which  the  surveillance  is  conducted, 
does  not  involve  any  physical  changes  to  the  plant,  does  not  alter  the  way  any  structure,  system, 
or  component  functions,  and  does  not  modify  the  manner  in  which  the  plant  is  operated.  As  such, 
the  proposed  change  in  the  interval  of  Surveillance  Requirement  4.7.3.b  will  not  degrade  the 
ability  of  the  PCC  system  to  perform  its  safety  function.  Also,  the  PCC  system  is  designed  to 
perform  its  intended  safety  function  even  in  the  event  of  a  single  failure. 

Equipment  performance  over  the  last  three  operating  cycles  was  evaluated  to  determine  the 
impact  of  extending  the  interval  of  Surveillance  Requirement  4.7.3.b.  This  evaluation  included  a 
review  of  surveillance  results,  preventive  maintenance  records,  and  the  frequency  and  type  of 
corrective  maintenance.  It  concludes  that  the  PCC  automatic  valves  are  highly  reliable,  and  that 
there  is  no  indication  that  the  proposed  extension  could  cause  deterioration  in  the  condition  or 
performance  of  any  of  the  subject  PCC  components. 

Since  the  proposed  change  only  affects  the  surveillance  interval  for  systems  that  are  used  to 
mitigate  accidents,  the  change  cannot  affect  the  probability  of  any  previously  analyzed  accident. 
While  the  proposed  change  can  lengthen  the  interval  between  surveillances,  the  increase  in  interval 
has  been  evaluated  and  it  is  concluded  that  there  is  no  significant  impact  on  the  reliability  or 
availability  of  these  systems  and  therefore,  there  is  no  impact  on  the  consequences  on  any 
analyzed  accident. 
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2,  Create  the  possibility  of  a  new  or  different  kind  of  accident  from  any  accident  previously 
evaluated. 

The  proposed  change  to  Surveillance  Requirement  4.7.3,b  of  the  PWR’s  Technical  Specifications 
extends  the  interval  for  verifying  that  each  automatic  valve  servicing  safety-related  equipment 
actuates  to  its  correct  position  on  its  associated  Engineered  Safety  Features  (ESF)  actuation 
signal.  The  proposal  would  extend  the  interval  from  at  least  once  per  18  months/refueling  to  at 
least  once  each  refueling  interval  (nominal  24-months  +  25%  =  30  months). 

The  proposed  change  does  not  alter  the  intent  or  method  by  which  the  surveillances  are 
conducted,  does  not  involve  any  physical  changes  to  the  plant,  does  not  alter  the  way  any 
structure,  system,  or  component  functions,  and  does  not  modify  the  manner  in  which  the  plant  is 
operated.  As  such,  the  proposed  change  cannot  create  the  possibility  of  a  new  or  different  kind  of 
accident  from  any  previously  evaluated. 

3.  Involve  a  significant  reduction  in  a  margin  of  safety. 

The  proposed  change  to  Surveillance  Requirement  4.7.3.b  of  the  PWR’s  Technical  Specifications 
extends  the  interval  for  verifying  that  each  automatic  valve  servicing  safety-related  equipment 
actuates  to  its  correct  position  on  its  associated  Engineered  Safety  Features  (ESF)  actuation 
signal.  The  proposal  would  extend  the  interval  from  at  least  once  per  18  months/reflieling  to  at 
least  once  each  refueling  interval  (nominal  24-months  +  25%  =  30  months). 

The  proposed  change  to  the  surveillance  interval  is  still  consistent  with  the  basis  for  the  interval 
and  the  intent  or  method  of  performing  the  surveillance  is  unchanged.  Further,  the  entire  system 
from  detectors  to  valves  is  either  tested  on  a  more  frequent  basis  than  T/S  4.7.3.b  to  confirm  its 
operability  or  previous  history  of  reliability  of  the  PCC  system  provides  assurance  that  the 
changes  will  not  affect  the  reliability  of  the  PCC  system.  Thus,  it  is  concluded  that  there  is  no 
impact  on  the  margin  of  safety. 
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PWR  TECHNICAL  SPECIFICATION  4.7.3.b 
Primary  Component  Cooling  Water 
Operations  Surveillance  History 
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PWR  TECHNICAL  SPECIFICATION  4.7.3.b 
Primary  Component  Cooling  Water 
Corrective  Maintenance  History 
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Chapter  6  -  A  Framework  for  Reducing  Forced  Outage  Rates 


6.1  Introduction 

The  primary  focus  of  this  thesis  is  the  development  and  application  of  a  strategy  for 
resolving  a  power  plant’s  surveillance  program  to  minimize  refueling  and  planned  maintenance 
outage  times  during  extended  fuel  cycles.  In  doing  this,  the  two  primary  goals  of  the  thesis  were 
met.  The  thesis  demonstrated  that,  with  the  exception  of  the  Category  C  surveillances  of  Chpater 
4,  the  regulatory  and  investment  protection  barriers  to  extended  cycle  lengths  perhaps  can  be 
overcome,  and  it  provided  a  systematic  surveillance  resolution  procedure  that  utilities  can  use  to 
prepare  for  extended  cycle  lengths.  The  two  other  key  issues  discussed  in  Chapter  1  that  must  be 
addressed  to  make  extended  fuel  cycles  attractive  to  the  nuclear  industry  are  increasing  the  cycle 
length  between  refuelings  through  improved  core  designs,  and  reducing  forced  outages  rates. 

Forced  outages,  as  defined  here,  include  any  unplanned  outages  during  an  operating  cycle. 
This  includes  plant  trips  and  short  term  controlled  shutdowns  to  complete  any  unexpected  repairs. 
Forced  outages  are  primarily  caused  by  either  equipment  failure  or  human  error.  The  impact  of 
human  error  on  forced  outages  is  difficult  to  quantify  but  has  been  estimated  to  account  for  as 
much  as  20%  of  the  overall  forced  outage  rate.*'*  This  is  because  many  forced  outages  which  on 
the  surface  appear  to  be  due  to  component  failure  actually  have  human  error  as  their  root  cause. 
For  example,  a  plant  trip  caused  by  a  loss  of  a  main  feed  pump  governor  control  valve  will  often 
be  reported  as  a  main  feed  pump  failure.  Yet,  further  investigation  of  the  failure  might  show  that 
the  governor  system  failed  because  the  wrong  type  of  fastener  was  used  in  assembling  the 
governor  during  the  last  outage.  So  although  an  equipment  failure  caused  the  forced  outage,  the 
fact  that  the  mechanical  failure  was  caused  by  improper  maintenance  means  that  the  forced  outage 
was  in  reality  caused  by  human  error.  The  distinction  is  vitally  important  when  attempting  to 
reduce  the  forced  outage  rates  for  extended  fuel  cycles.  Since  the  possibility  of  human  error 
always  exists,  increasing  the  number  or  frequency  of  surveillances  or  maintenance  items  will 


Conversation  with  Dr.  Chong  Chiu,  San  Onofre,  June  1995  at  the  MIT  Summer  Reactor  Safety  Seminar. 
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always  tend  to  increase  the  forced  outage  rate  due  to  human  error.  Conversely,  reducing  the 
number  and  frequency  of  surveillances  or  maintenance  items  will  reduce  the  forced  outage  rates 
due  to  human  error.  The  key  then  is  to  determine  the  optimum  types  and  frequency  of 
surveillances  and  maintenance  such  that  the  combination  of  forced  outage  rates  from  equipment 
failure  and  human  error  are  minimized.  This  topic  will  form  the  basis  for  significant  future  work. 

Because  quantifying  and  reducing  the  impact  of  human  error  on  the  plant  force  outage  rate 
is  extremely  difficult,  a  different  approach  is  taken  towards  the  goal  of  reducing  forced  outages  to 
less  than  3%^^  (~40  days)  during  a  48  month  fuel  cycle.  This  approach  focuses  almost  exclusively 
on  understanding  and  reducing  component  root  causes  of  failure  as  the  best  way  to  improve 
individual  component  reliability.  By  improving  component  reliability  there  will  be  an  indirect 
reduction  of  the  impact  of  human  error  on  plant  forced  outage  rates  because  more  reliable 
equipment  will  require  less  maintenance  and  testing.  Reducing  the  amount  of  maintenance  and 
testing  means  less  human  involvement,  and  thus  less  chance  of  introducing  human  error.  The 
question  then  that  must  be  answered  is  “Can  the  component  be  expected  to  run  reliably  for  at 
least  48  months  with  no  maintenance  which  requires  the  component  to  be  removed  from  service?” 
If  the  answer  to  that  question  is  yes,  then  the  interval  between  surveillances  or  maintenance  is  at 
least  48  months  and  the  component  will  not  pose  a  barrier  to  an  extended  fuel  cycle. 

Li  and  Golay'^  determined  for  the  Condensate-Feedwater  System  that  to  achieve  a  97% 
system  capacity  factor  (3%  forced  outage  rate),  the  overall  independent  component  mean  time  to 
failure  must  be  approximately  lO'^/hr  or  better  if  no  repair  time  is  considered  as  shown  in  figure  6- 
1  at  point  A.  Figure  6-1  shows  that  if  repair  is  also  considered,  and  the  average  repair  time  is 
1000  hours  (~40  days)  then  the  allowable  failure  rate  of  the  component  is  2xlO'Vhr  as  shown  at 
point  B.  If  average  repair  times  are  reduced  to  100  hours  (~4  days),  then  allowable  component 
failure  rate  is  2xl0  Vhr  as  shown  at  point  C.  Therefore,  if  component  failure  rates  are  determined 
to  be  lO'Vhr  or  better,  no  further  improvements  to  the  components  performance  is  required  to 
make  it  compatible  with  a  48  month  fuel  cycle.  These  analyses  neglect  the  effects  of  common 


The  3%  goal  is  based  on  the  probable  U.S.  utility  industry  forced  outage  rate  taget  for  the  year  2000. 

Golay,  Michael,  and  Li,  Feng,  “Results  Summary  from  Reliability  Sensitivity  Analysis  for  a  PWR  Condensate- 
Feedwater  System”,  May  1996, 
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cause  failure.  For  component  failure  rates  which  do  not  meet  the  lO'Vhr  target,  two  options  exist 
to  reach  the  97%  system  capacity  factor  goal.  First,  the  component  could  be  improved  to  reach 
the  lO'Vhr  failure  rate  target  independent  of  repair,  or  second,  the  component  failure  rate  and  the 
average  time  to  repair  could  both  be  improved  so  that  in  combination  they  meet  the  97%  system 
capacity  factor  goal.  Both  options  should  be  explored  in  detail  and  the  most  economic  plan 
chosen.  Note  that  this  study  assumed  that  the  rest  of  the  plant  did  not  contribute  to  the  overall 
forced  outage  rate.  Therefore,  the  actual  failure  rates  needed  to  achieve  a  plant  capacity  factor  of 
97%  will  be  somewhat  higher  than  the  values  stated  here. 

Allowable  Failure  Rates  of  Active  Components  Needed  to 
Achieve  a  Component  97%  Capacity  Factor  with  Various  Repair  Times 

Figure  6  - 1’’ 


No  repair 

Repair  rate  of  active  components:  lOE-1  /hr 
“*■  Repair  rate  of  active  components:  lOE-2  /hr 
—  Repair  rate  of  active  components:  lOE-3  /hr 

Because  passive  components  such  as  heat  exchangers  are  typically  considered  to  have 
failure  rates  which  are  already  at  least  10'%r  or  better,  the  components  that  should  be  examined 
first  are  components  where: 


Li,  Feng,  and  Golay,  Michael,  "Results  Summary  from  Reliability  Sensitivity  Analysis  for  a  PWR  Condensate- 
Feedwater  System",  Department  of  Nuclear  Engineering,  Massachusetts  Institute  of  Technology,  May  1996,  p.  16. 


168 


•  Failure  will  result  in  a  reactor  trip  or  shutdown  and  where, 

•  No  redundancy  exists  when  the  plant  is  operating  at  rated  power 

Fortunately,  there  are  very  few  components  at  a  typical  PWR  that  meet  these  two  criteria. 
These  include  the  Reactor  Coolant  Pumps  of  which  there  are  typically  four  per  plant,  the  Main 
Turbine  and  Generator  of  which  there  is  typically  only  one,  the  Main  Feed  Pumps  (MFP)  of  which 
there  are  typically  two,  and  selected  portions  of  the  Electrical  Distribution  and  Reactor  Protective 
Systems. 

A  1994  study  by  Yankee  Atomic  entitled  "Operational  Reliability  Analysis  of  Seabrook 
Station",  November  1994,  concluded  from  a  review  more  than  900  Westinghouse  NSSS  system 
trip  experiences  between  1985  to  mid- 1993  that  the  following  components  or  systems  had  the 
largest  contribution  to  the  overall  plant  forced  outage  rate  and  were  the  driving  factors  in  overall 
plant  reliability: 

•  Turbine  Generator  and  Turbine  Generator  Controls 

•  Feedwater  and  Feedwater  Controls 

•  Electrical  Distribution 

•  Reactor  Protection'* 


Because  of  these  results,  these  types  of  components  should  be  studied  first  in  an  overall 
strategy  to  reduced  plant  forced  outage  rates  below  3%.  The  overall  strategy  for  reducing  forced 
outage  rates  must  address  the  following  key  issues; 

•  Current  component  or  system  reliability  levels 

•  Major  component/system  failure  mechanisms  and  their  root  causes 

•  Current  surveillance  program’s  impact  on  overall  component  or  system  reliability 


O'Regan,  Patrick  J.,  "Operational  Reliability  Analysis  of  Seabrook  Station",  Yankee  Atomic  Energy  Corporation 
Contract  1880,  November  1994.  p.  23. 
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Of  the  components  discussed  previously,  the  MFP  was  chosen  as  the  initial  candidate  to 
study  in  detail  because  of  its  relative  simplicity  and  because  of  the  access  to  data  and  the 
personnel  necessary  to  conduct  the  research.  This  chapter  begins  the  work  necessary  to  answer 
the  question  of  whether  the  MFP  can  be  expected  to  run  reliably  without  being  shutdown  for  at 
least  48  months.  It  includes  research  on  the  root  causes  of  MFP  failures,  as  well  as  interviews 
with  industry  personnel,  maintenance  and  diagnostic  experts,  pump  consultants,  vendors,  and 
manufacturers  of  significant  pump  sub-systems  such  as  mechanical  seals.  While  not  providing  the 
final  answer  to  the  question  of  whether  the  MFP  will  run  reliably  for  at  least  48  months,  this 
chapter  lays  the  groundwork  and  direction  for  future  work  on  the  MFP  as  well  as  a  framework  for 
investigating  other  key  plant  components  such  as  those  mentioned  in  the  preceding  paragraph. 

6.2  Estimates  of  Current  Main  Feed  Pump  Reliability 

The  first  step  in  reducing  forced  outage  rates  is  to  determine  as  accurately  as  possible  the 
current  reliability  levels  of  the  component  or  system  independent  of  repair.  This  is  vital  to 
understanding  the  component  or  systems  contribution  to  the  overall  plant  forced  outage  rate  as 
well  as  providing  a  starting  point  for  determining  how  much  reliability  improvement  in  the 
component  or  system  is  needed  to  meet  the  goal  of  an  overall  plant  forced  outage  rate  of  no  more 
than  3%. 

The  first  step  in  determining  the  current  reliability  levels  of  the  MFP  was  a  review  of 
Westinghouse  Plant  Licensee  Event  Reports  (LER),  written  from  1985  to  1993,  which  reported 
the  cause  of  plant  shutdown  as  the  Feedwater  System.  This  review,  conducted  as  part  of  a  1994 
single  component  failure  study  at  the  candidate  PWR  found  250  LER’s  which  reported  the  cause 
of  plant  shutdown  as  the  Feedwater  System.  These  250  LER’s  were  then  further  broken  down  by 
the  author  of  this  thesis.  The  event  description  of  each  LER  was  examined  to  determine  the 
actual  cause  of  the  shutdown.  Shutdowns  caused  by  component  failure  which  were  the  result  of 
improper  maintenance  or  installation  were  classified  as  human  errors.  Of  the  250  Feedwater 
System  LER’s  which  caused  shutdowns,  55  were  attributable  to  the  Main  Feed  Pump.  These  55 
LER’s  were  further  broken  down  by  their  root  causes.  The  causes  and  the  number  of  occurrences 
of  each  are  shown  in  table  6-1 . 
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LER  Reported  Causes  of  MFP  Failures  (1985-1993) 
Leading  to  Plant  Trips 

Table  6  -  1 


Cause 

Number 

Shaft  Failure 

1 

Turbine  Failure 

2 

Motor  Failure 

3 

5 

3 

Speed  Control  System 

18 

Lube  Oil 

15 

Vibration 

1 

Valves  Associated  with  Pump 

7 

There  are  77  PWR  plants  in  the  United  States.  It  was  assumed  that  the  plants  on  average 
had  two  MFP’s  each  for  a  total  of  144  pumps  in  the  study.  It  was  also  assumed,  based  on 
discussions  with  plant  engineers  that  MFP’s  were  operational  75%  of  the  time  over  the  course  of 
the  nine  years  studied.  Note  that  this  75%  is  not  the  plant  capacity  factor,  but  an  estimate  of  the 
average  operating  time  of  the  Main  Feed  Pump  during  the  course  of  a  year.  Based  on  this 
information,  a  first  estimate  of  the  MFP  failure  rate  was  calculated. 


MFP  Failure  Rate  =  55  failures/(144  pumps*9  years*365.25d/yr*24hr/day*.75) 

6.46*10Vhr 

This  initial  estimate  of  the  MFP  failure  rate  is  close  to  the  value  of  1 0'Vhr  needed  to 
support  the  goal  of  a  system  97%  capacity  factor  assuming  no  repairs  are  considered.  Improving 
the  reliability  of  the  MFP  by  a  factor  of  about  six  is  needed  to  meet  the  project  goals  assuming  no 
repair.  Although  the  case  of  no  repair  is  artificial,  it  does  provide  an  excellent  target  for 
improving  component  reliability.  If  a  component’s  reliability  can  be  economically  improved  to  the 
point  where  it  meets  target  capacity  factor  goals  without  repair,  it  will  clearly  support  capacity 
factor  goals  if  repair  is  allowed. 

A  second  and  possibly  more  accurate  estimate  of  MFP  failure  rates  was  obtained  through 
a  search  of  the  Nuclear  Plant  Reliability  Data  System  (NPRDS).  This  search  revealed  205  events 
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caused  by  MFP’s  that  resulted  in  either  a  plant  trip,  plant  shutdown,  or  a  reduction  in  power. 

This  data  was  over  approximately  the  same  time  period  as  the  LER  trip  history  data,  but  includes 
all  110  licensed  power  plants  (both  PWR  and  BWR)  in  the  United  States.  The  leading  causes  of 
MFP  failures  from  this  search  are  as  shown  in  Figure  6-2. 

NPRDS  Leading  Causes  of  MFP  Failures 
Figure  6-2 


Using  the  NPRDS  results,  one  obtains  an  estimated  failure  rate  of: 

MFP  failure  rate  =  205/(220  pumps*9  years*365.25d/yr*24hr/day*.75) 

1.57xl0^/hr 

Although  this  failure  rate  is  almost  two  and  one-half  times  greater  than  the  first  calculated 
failure  rate,  it  is  important  to  remember  that  more  than  75%  of  the  MFP  failures  reported  in  the 
NPRDS  system  did  not  require  the  plant  to  be  shutdown.  Most  of  the  repairs  were  conducted 
with  the  plants  at  powers  ranging  from  50%  to  67%,  depending  on  the  number  and  capacity  of  the 
remaining  pumps  available.  Thus,  while  the  overall  failure  rate  is  somewhat  higher,  its  overall 
impact  on  the  plant  capacity  factor  is  probably  smaller  because  the  plants  retain  the  capability  to 
produce  power  during  the  course  of  many  of  these  MFP  repairs. 

In  order  to  get  an  estimate  for  the  average  outage  times  following  a  trip  caused  by  a  MFP 
failure,  a  review  was  conducted  of  the  database  maintained  by  the  NRC  which  documents  plant 
performance.  From  1989  to  mid- 1995  there  were  a  total  of  24  forced  outages  industry-wide 
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caused  by  problems  with  a  MFP.  The  average  outage  hours  for  these  24  events  was  51.3  hours. 
Using  this  as  an  estimate  of  the  average  repair  time  for  MFP  failures  and  referring  back  to  figure 
6-1,  one  obtains  an  allowable  MFP  failure  rate  of  about  SxlO’Vhr  needed  to  achieve  a  system  97% 
capacity  factor. 

These  initial  estimates  of  the  current  MFP  reliability  demonstrate  that  the  MFP  reliability 
levels  are  probably  already  very  close  to  the  point  where  they  could  reliably  support  extended 
cycles  of  48  months.  The  results  of  all  these  calculations  are  summarized  in  table  6-2  below. 
However,  even  though  initial  reliability  estimates  may  demonstrate  that  a  component  could  be 
expected  to  operate  reliably  over  an  extended  cycle,  further  component  reliability  improvements 
should  be  pursued.  The  3%  forced  outage  goal  is  the  upper  limit  on  acceptable  forced  outage 
rates.  If  additional  economic  reliability  improvements  can  be  made  to  a  component  which  will 
contribute  to  even  lower  forced  outage  rates,  they  should  be  strongly  considered.  Additionally, 
maximizing  the  reliability  of  individual  components  will  also  help  offset  the  impact  of  any 
components  whose  reliability  levels  cannot  be  economically  improved.  Therefore,  further  sections 
in  this  Chapter  will  focus  on  the  root  causes  of  failures  of  MFP’s  and  address  some  of  the 
recommended  design,  installation,  and  operational  techniques  to  improve  MFP  performance. 


Summary  of  MFP  Failure  Rate  Estimates 
Table  6  -  2 


Method 

Failure:  Rate  ; 

LER  Review  of  Main  Feed  Pump  Trips 
(No  Repairs  Assumed) 

6.46  E-6  (Calculated) 

NPRDS  Review  of  all  MFP  Trips,  Shutdowns,  Power 
Reductions  (No  Repairs  Assumed) 

1.57  E-5  (Calculated) 

Allowable  MFP  Failure  Rates  Given  a 

50  Hour  Average  Repair  Time 

3,0  E-4  (Allowed) 
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6.3  Root  Causes  of  Main  Feed  Pump  Failures 


6.3.1  Introduction 

Based  on  the  service  requirements  for  main  feed  pumps  used  in  the  nuclear  industry,  they 
should  exhibit  very  high  reliability  levels.  Because  nuclear  power  plants  operate  at  much  lower 
temperatures  than  fossil  plants,  very  high  steam  flow  rates  are  required  to  the  turbine  generators 
to  deliver  the  steam  energy  necessary  to  produce  large  amounts  of  power,  on  the  order  of  as 
much  as  1200  MWe.  These  high  mass  flow  rates  result  in  the  need  for  feed  pumps  which  have 
very  high  capacity  but  much  lower  head  requirements  than  those  required  for  fossil  plants.  These 
requirements  are  typically  met  with  a  single  stage,  high  capacity,  high  speed  pump.  Most  plants 
use  two  50%  capacity  pumps,  with  some  of  the  older  designs  using  three  50%  pumps.  The  single 
stage  pump  means  that  the  impeller  shaft  is  shorter  and  thus  the  bearing  spans  are  much  closer 
than  a  typical  fossil  plant  MFP.  The  shorter  bearing  spans  typically  mean  more  even  load 
distributions  on  the  bearings  and  thus  longer  life.  The  shorter  shafts  also  mean  that  there  is  less 
flexing  in  the  shaft,  resulting  in  a  lower  likelihood  of  misalignment  and  vibration,  two  of  the 
leading  causes  of  impeller,  bearing,  or  seal  failures.  Additionally,  nuclear  plants  are  most  often 
operated  at  rated  power  as  opposed  to  commercial  fossil  plants  which  are  typically  operated  on  a 
cycling  or  load  following  mode  based  on  the  local  grids  demand.  Because  of  this,  nuclear  feed 
pumps  should  be  able  to  operate  for  longer  periods  closer  to  their  best  efficiency  point  (BEP)  as 
illustrated  in  figure  6-3  below. 

Figure  6-3  shows  the  combination  of  flow  and  pump  head  which  result  in  the  pump 
operating  at  its  Best  Efficiency  Point  (BEP).  Operating  at  the  BEP  is  important  not  only  because 
it  represents  the  maximum  hydraulic  efficiency  point,  and  thus  requires  the  least  energy  to  run  the 
pump,  but  also  because  operations  at  this  point  are  known  to  result  in  the  most  most  efficient  flow 
streams  within  the  pump.  The  most  efficient  flow  streams  result  in  the  lowest  possible  dynamic 
stresses  in  the  pump  and  various  pump  components,  lower  risk  of  cavitation,  and  therefore  longer 
lifetimes  for  pump  components  as  well  as  reduced  maintenance. 


”  Feedpump  Operation  and  Design  Guidelines  -  Summaiy  Report.  Prepared  by  Sulzer  Brothers  Limited, 
Winterthur,  Switzerland  for  the  Electric  Power  Research  Institute.  Final  Report,  June  1993.,  pgs.  1-7. 
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Main  Feed  Pump  Operating  Curves 


Figure  6-3 


Head 


Flow 


Given  these  inherent  advantages,  the  MFPs  used  in  the  nuclear  industry  should  exhibit 
significantly  higher  reliability  levels  than  their  fossil  counterparts.  However,  in  general  this  is  not 
the  case.  The  American  Electric  Power  Company  (AEPC),  for  instance,  uses  only  one,  multi¬ 
stage,  70,000  horsepower  feed  pump  for  their  1300  MWe  fossil  plant  designs.  These  pumps 
which  have  historical  availabilities  of  around  99%  match  or  exceed  the  availabilities  of  most  of  the 
MFPs  used  in  the  nuclear  industry.  AEPC  feed  pumps  must  be  reliable  or  their  plants  cannot 
operate,  and  they  are. 

The  remaining  portions  of  this  chapter  will  focus  on  the  major  failure  mechanisms 
exhibited  by  nuclear  MFPs,  their  principal  root  causes,  and  some  general  recommendations  for 
how  to  reduce  the  particular  failure  mechanism.  Based  on  conversations  with  many  pump  experts 
ranging  from  vendors  to  plant  engineers,  most  of  the  pump  failure  mechanisms  and  many  of  their 
root  causes  of  failure  are  already  fairly  well  understood.  In  many  cases,  there  are  also  detailed 
recommendations  for  how  to  reduce  these  failures.  However,  the  detailed  understanding  of  the 
root  causes  of  failures  and  potential  solutions  for  their  elimination  does  not  appear  to  be 
incorporated  into  the  day  to  day  maintenance  and  operations  of  the  pumps.  Most  importantly, 
despite  all  the  knowledge  that  exists  on  pump  design  and  operation,  it  does  not  appear  that  there 
has  been  a  serious  effort  to  make  a  quantitative  connection  between  recommended  solutions  and 
subsequent  improvements  in  pump  reliability.  For  example,  how  much  more  reliably  would  a 
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MFP  run  if  it  was  always  operated  at  its  best  efficiency  point  (BEP)?  What  are  the  quantitative 
reliability  trade-offs  from  operating  to  the  left  or  right  of  the  BEP  as  shown  at  points  B  and  C  on 
figure  6-4? 


Other  Main  Feed  Pump  Operating  Points 
Figure  6-4 


As  another  example,  the  industry  today  is  using  more  and  more  sophisticated  monitoring 
and  diagnostic  equipment  to  monitor  feed  pump  performance.  These  new  systems  are  estimated 
to  cost  about  $50,000  per  pump  to  install,  not  to  mention  the  costs  of  training  people  in  how  to 
use  the  equipment.  Yet,  no  one  interviewed  could  conclusively  say  what  the  quantitative 
reliability  gains  would  be  from  using  this  type  of  equipment.  In  an  age  of  increased  competition, 
utilities  must  understand  the  cost  benefits  of  their  engineering  options.  Quantifying  the  reliability 
gains  from  various  options  typically  employed  to  improve  pump  reliability  should  form  the  basis 
for  significant  future  study  within  the  industry. 


6.3.2  Major  Failure  Mechanisms  and  Root  Cause  Discussion 

Figure  6-5  contains  a  simplified  diagram  which  summarizes  the  principal  failure 
mechanisms  and  their  root  causes  for  MFP’s.  The  diagram  was  developed  based  on  a  review  of 
NPRDS  failure  data,  LER’s,  and  discussions  with  experts  in  the  main  feed  pump  field.  The 
number  or  letter  associated  with  each  box  allows  for  a  ready  classification  scheme  that  could  be 
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applied  to  all  MFP  failures  and  placed  in  a  database  for  analysis.  For  instance  a  MFP  failure 
caused  by  seal  leakage,  where  the  seal  failed  due  to  vibration  caused  by  an  initial  misalignment  of 
the  pump  would  be  classified  as  A. l.a.i. 

Two  root  causes  which  were  not  included  in  Figure  6-5  were  failure  due  to  normal  wear 
and  failure  due  to  human  error.  These  root  causes  accounted  for  58  of  the  205  (28%)  MFP 
failures  reported  in  NPRDS  which  resulted  in  a  plant  trip,  shutdown,  or  power  reduction.  This 
includes  40  of  205  (19.5%)  which  were  attributed  to  normal  wear  and  18  of  205  (8.7%)  which 
were  attributed  to  human  error.  However,  based  on  a  review  of  plant  material  history,  pump 
maintenance  schedules,  and  discussions  with  pump  experts,  it  is  likely  that  the  expected  lifetime  of 
components  such  as  bearings,  seals,  pump  impellers,  and  wearing  rings,  subject  to  normal  wear  is 
well  in  excess  of  48  months  and  therefore  should  not  adversely  impact  on  pump  reliability  levels 
during  a  48  month  cycle.  Also,  as  noted  in  the  beginning  of  this  chapter,  this  study  does  not 
attempt  to  correct  failures  resulting  from  human  error  with  the  exception  of  that  by  reducing  the 
maintenance  intervals  of  plant  components,  that  part  of  the  total  failure  rate  due  to  human  error  is 
reduced. 

6.3.2.1  Major  Failure  Mechanisms 

6.3.2. 1.1  Seals 

Seal  failures  accounted  for  the  largest  number  of  MFP  reported  failures.  Of  the  205 
reported  MFP  failures,  70  were  caused  by  seal  failures.  Seal  failures  were  reported  as  being  most 
often  caused  by  improper  installation,  misalignment,  vibration,  material  deficiencies,  and  debris 
injected  into  the  seal.  By  far,  the  largest  contributor  to  seal  failure  was  dirt  or  debris  injected  into 
the  seal  area  resulting  in  scoring  or  clogging  of  the  seal  area.  The  scoring  of  the  seal  results  in 
uneven  pressure  distributions  across  the  seal  faces  which  ultimately  leads  to  leakage.  Debris  in 
the  seal  area  can  also  reduce  the  amount  of  cooling  water  to  the  seals  resulting  in  seal 
overheating,  distortion,  damage,  and  ultimately  leakage.  Maintaining  clean  flush  water  at  the 
proper  pressures  and  flow  is  vital  to  long  term  seal  performance. 

Two  of  the  major  seal  types  used  on  feed  pumps  are  throttle  bushing  seals  and  mechanical 
seals.  Throttle  bushings  are  used  on  most  fossil  industry  MFPs  and  some  PWR  MFPs.  They 
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Main  Feed  Pump  Failure  Diagram 
Figure  6-5 
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have  a  history  of  very  reliable  long-term  performance  but  have  several  disadvantages.  First,  they 
generally  have  much  higher  leak  rates  than  mechanical  seals  and  may  require  special  drains.  The 
leakage  results  in  larger  makeup  quantities  of  expensive  feedwater.  They  also  require  close 
clearances  which  are  difficult  to  achieve  and  therefore  costly.  Finally,  for  nuclear  power  plants, 
the  leakage,  especially  at  Boiling  Water  Reactors,  may  be  a  radiological  concern.  At  most 
PWR’s,  throttle  bushing  leakage  is  more  a  makeup  water  concern  than  it  is  a  radiological  concern. 

Mechanical  seals  come  in  a  variety  of  designs.  The  major  advantage  of  mechanical  seals  is 
that  they  are  relatively  leak  free.  Mechanical  seals  have  a  wide  variety  of  applications  and  are 
widely  used  in  the  chemical  and  oil  industry  where  pumps  are  required  to  pump  fluids  which  are 
very  dangerous  to  humans  and  the  environment  and  for  which  little  to  no  leakage  can  be  allowed. 
They  are  often  used  in  Boiling  Water  Reactors,  where  the  water  in  the  feed  system  is 
contaminated  and  less  leakage  is  allowed.  They  are  also  used  in  many  instances  in  PWR  MFPs. 
Based  on  discussions  with  a  leading  seal  manufacturer,  mechanical  seals  have  a  typical  service  life 
of  six  to  eight  years  when  installed  properly  and  operated  under  design  conditions.  The  most 
common  type  of  seals  used  for  feed  pump  applications  are  balanced,  pusher,  rotating  seat  seals.  A 
rotating  seal  face  of  antimony  filled  carbon  bearing  upon  reaction  bonded  silicon  carbide  offers  the 
best  combination  of  seal  wear,  corrosion  characteristics,  and  thermal  conductivity.^® 

A  survey  of  seal  failures  in  the  United  States  by  one  of  the  world’s  largest  seal 
manufacturers^*  found  that  the  principal  causes  of  mechanical  seal  failures  were: 

•  40%  Operational  Problems  -  caused  by  items  such  as  flow  interruptions 

•  24%  Mechanical  Difficulties  -  caused  by  assembly  errors,  incorrect  clearances, 
inadequate  alignment 

•  19%  Faulty  Fluid  Circuit  Design  -  caused  by  insufficient  suction,  deficient  flush  circuit, 
and  pumps  unsuitable  for  the  design  service  conditions 

•  9%  Poor  Seal  Selection  -  caused  by  the  wrong  materials  or  wrong  configuration 

•  8%  Other 


Presentation  to  the  MIT  Extended  Cycle  Project  Group  by  Steve  Jambor  of  John  Crane,  Inc.,  24  April  1996,  p. 
80. 

Crane,  p.  66. 
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6.3.2.1.2  Bearings 

Bearing  failures  accounted  for  the  second  largest  number  of  MFP  reported  failures.  Of  the 
205  reported  MFP  failures,  35  were  caused  by  bearing  failures.  The  principal  causes  of  bearing 
failure  were  misalignment  or  vibration  in  the  pump  causing  excess  bearing  loads,  and  lube  oil 
system  related  problems.  Lube  oil  system  related  problems  were  reported  as  being  principally 
caused  by  two  major  factors.  First,  contaminants  in  the  oil  (water  or  debris)  which  can  damage 
bearing  faces  or  reduce  cooling  to  the  bearing.  Second,  a  complete  loss  of  lube  oil  to  the  bearing 
which  results  in  a  short  term  catastrophic  failure  of  the  bearing  babbit  surfaces. 

One  attractive  alternative  currently  being  explored  is  the  use  of  magnetic  bearings. 
Magnetic  bearings  are  self-aligning  and  require  no  lube  oil,  the  leading  cause  of  bearing  failure. 
The  U.S.  Navy  has  started  to  use  these  types  of  bearings  on  their  turbine  generators  and  the 
Electric  Power  Research  Institute  (EPRI)  is  currently  investigating  their  use  on  a  wide  range  of 
pumps  and  turbines.  The  major  drawback  of  magnetic  bearings  is  that  they  are  relatively 
expensive  and  would  require  equipment  modifications  to  backfit  them  into  existing  components 
including  the  MFP. 


6.3.2.1.3  Control  Systems 

Control  systems  were  the  third  leading  reported  cause  of  MFP  failures  accounting  for  20 
of  the  205  MFP  failures  which  resulted  in  a  plant  trip,  plant  shutdown,  or  reduction  in  power. 
Additionally,  control  system  failures  were  the  cause  of  18  of  the  55  trips  associated  with  MFP’s  in 
the  review  of  LER  feedwater  system  trips  between  1985  and  1993.  The  principal  cause  of  control 
system  failures  was  problems  associated  with  the  lube  oil.  Similar  to  the  bearing  problems 
discussed  above,  loss  of  oil  or  loss  of  oil  cleanliness  was  the  root  cause  of  control  system  failures. 
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6.3.2. 1.4  Pump  Structures 

Unlike  the  other  failure  mechanisms  discussed  previously,  pump  structures  are  not  as 
significant  a  contributor  to  the  overall  failure  rate  of  the  MFP,  accounting  for  16  of  the  205 
reported  MFP  failures  which  caused  a  plant  trip,  shutdown,  or  reduction  in  power.  Pump 
structures  include  the  pump  shaft,  impeller,  and  casing.  These  failure  mechanisms  are  important 
though  because  of  their  impact  on  the  plant  capacity  factor.  Failures  of  the  pump  structure 
typically  result  in  more  severe  damage  to  the  pump.  This  generally  causes  the  cost  and  time  to 
repair  the  pump  to  be  higher  for  this  type  of  failure  than  any  other  kind.  Most  of  the  casing  and 
shaft  damage  is  the  result  of  poor  manufacturing  techniques.  The  principal  causes  of  impeller 
damage  are  vibration  caused  by  pump  misalignment,  operation  of  the  pump  for  significant  periods 
of  time  at  other  than  design  conditions,  and  cavitation  caused  by  insufficient  suction  pressures. 


6.3.2.2  Major  Root  Causes  of  Failure 

Based  on  research  of  MFP  material  records  and  discussions  with  pump  experts  there 
appears  to  be  three  major  root  causes  of  MFP  failures.  These  include: 

•  Vibration  Induced  Failures 

•  System  Cleanliness  Failures 

•  Pump  or  System  Design  Failures 

Each  of  these  areas  is  discussed  in  more  detail  in  the  following  sections. 

6.3.2.2.1  Vibration  Induced  Failures 

Vibration  is  probably  the  leading  cause  of  failure  in  all  types  of  rotating  machinery 
including  MFP’s.  Often  vibration  failures  show  up  as  failures  in  bearings,  seals,  or  other  pump 
internals.  Vibration  was  the  root  cause  of  failure  in  55  of  the  205  MFP  failures  studied.  Vibration 
is  primarily  caused  by  three  major  areas,  misalignment,  improper  design,  and  operation  of  the 
pump  at  other  than  design  conditions. 
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Misalignment  can  be  caused  by  several  factors.  The  first  is  obviously  from  an  initial 
misalignment  of  the  pump  during  installation  or  following  repair.  This  can  occur  as  a  result  of 
operator  error,  but  is  most  likely  the  result  of  not  accounting  for  the  alignment  differences  when 
the  pump  is  hot  and  cold.  Proper  alignment  procedures  should  include  both  a  cold  and  hot 
alignment,  with  the  hot  alignment  being  the  most  vital  since  this  is  the  condition  where  the  pump 
is  most  often  operated.  Advanced  optical  alignment  techniques  are  available  to  assist  technicians, 
but  many  pump  experts  say  that  these  tools  are  not  any  better  than  the  older  reverse  dial  indicator 
method  of  pump  alignment. 

Misalignment  can  also  be  caused  by  nozzle  loading.  This  is  especially  a  problem  in  the 
nuclear  industry  where  the  large  flow  rates  of  the  pumps  requires  very  large  suction  and  discharge 
piping.  This  piping,  also  experiences  thermal  expansion  during  plant  heatup,  and  if  not  properly 
anchored  or  designed  to  allow  for  expansion  will  transmit  nozzle  loads  to  the  pump  which  will 
move  the  pump  out  of  alignment.  Essentially,  the  pump  should  not  be  used  as  the  anchor  point 
for  its  suction  and  discharge  piping.  One  leading  pump  manufacturer  stated  that  solving  the 
nozzle  load  issue  was  the  critical  factor  in  the  long  term  reliable  operation  of  nuclear  MFP’s. 

The  coupling  between  the  pump  and  its  driver  is  also  a  critical  factor  in  the  misalignment 
of  MFP’s.  Couplings  should  be  designed  to  absorb  some  misalignment  differences  between  the 
pump  and  the  driver.  However,  couplings  which  are  designed  to  handle  the  largest  amount  of 
misalignment  are  not  well  suited  to  the  high  loads  and  high  speeds  required  of  the  MFP’s  used  in 
the  nuclear  industry.  Several  of  the  coupling  failures  found  in  the  research  were  due  to 
inadequate  lubrication  of  the  coupling  itself 

Finally,  thermal  effects  play  a  large  role  in  MFP  misalignment.  Thermal  effects  manifest 
themselves  in  increased  nozzle  loads,  but  also  play  a  major  role  in  the  misalignment  of  pumps 
which  are  improperly  mounted.  MFP’s  should  be  center  mounted  with  the  driver  hard  mounted 
to  the  foundation  and  the  pump  free  to  move  axially  on  a  sliding  foot.  Failure  to  properly 
lubricate  this  sliding  foot  area  can  result  in  pump  misalignments  due  to  thermal  effects. 

Improper  design  of  the  pump  is  also  a  leading  cause  of  MFP  vibration.  There  are  too 
many  areas  of  pump  design  which  have  the  goal  of  reducing  pump  vibration  to  discuss  here. 
However,  there  are  two  significant  areas  which  warrant  a  brief  discussion. 
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The  first  is  the  adjustment  of  the  two  gaps  at  the  impeller  periphery.  The  first  gap, 
generally  referred  to  as  the  “A”  gap,  is  the  gap  between  the  sidewall  of  the  pump  casing  and  the 
impeller  itself  This  gap  should  be  made  as  small  as  possible  to  prevent  high  pressure  water  at  the 
impeller  discharge  from  leaking  back  to  the  suction  side  of  the  pump.  This  leakage  sets  up 
recirculations  in  the  pump  which  cause  vibrations.  However,  reducing  the  “A”  gap  means  that  the 
clearances  are  so  small  that  any  misalignment  of  the  pump  will  result  in  premature  wearing  of  the 
pump  wearing  rings,  setting  up  higher  recirculation  levels  and  thus  more  vibration.  The  second 
gap,  commonly  referred  to  as  the  “B”  gap,  is  the  gap  between  the  impeller  leading  edge  and 
diffuser  or  volute  at  the  outlet  to  the  pump.  This  gap  should  be  increased  to  reduce  the  intensity 
of  the  interaction  between  the  impeller  and  the  diffuser  or  volute.  Increasing  this  gap  from  three 
percent  to  five  percent  of  impeller  radius  reduces  the  pressure  pulsations  and  loads  which  cause 
vibration  by  more  than  half  However,  increasing  the  “B”  gap  too  much  will  result  in  a  loss  of 
pump  efficiency. 

The  second  important  design  consideration  in  reducing  the  vibration  levels  of  the  MFP  is 
to  design  the  MFP  so  that  it’s  best  efficiency  point  corresponds  to  the  normal  operating 
conditions  of  the  plant.  As  was  stated  previously,  operations  at  this  point  are  known  to  result  in 
the  lowest  dynamic  stresses  in  the  pump  and  various  pump  components,  lower  risk  of  cavitation, 
and  therefore  longer  lifetimes  for  pump  components  as  well  as  reduced  maintenance.  However, 
most  nuclear  feed  pumps  are  designed  with  additional  flow  margins  because  of  safety 
considerations.  Many  plants  were  also  originally  designed  with  extra  flow  capability  in  case  the 
plant  wanted  to  upgrade  the  rated  capacity  of  the  plant  at  some  later  date.  Both  of  these 
considerations  result  in  MFP’s  whose  BEP  is  not  at  the  normal  operating  conditions  of  the  pump. 
This  condition  can  be  corrected  by  “tuning”  the  pump.  Tuning  the  pump  involves  shaving  the 
impeller  to  change  the  pump  characteristics  so  that  the  pump  is  operating  at  BEP  at  the  normal 
operating  conditions  of  the  plant.  Utility  managers  and  plant  designers  should  consider  the  trade¬ 
offs  in  increased  pump  reliability  with  the  need  for  rarely  used  higher  capacity  capabilities. 


Cooper,  Paul,  Wotring,  Timothy,  and  Makay,  Elemer,  “Minimum  Continuous  Stable  Flow  in  Feed  Pumps”. 
Ingersoll  Rand  Company,  p.  2. 
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Pump  operation  is  the  last  major  contributor  to  vibration.  Pump  operation  is  analogous  to 
the  design  issues  surrounding  BEP.  Even  if  the  pump  is  designed  so  that  normal  operations  are 
not  at  the  pump’s  BEP,  operators  should  attempt  to  get  as  close  as  possible  to  BEP.  This  means 
that  multiple  MFP’s  should  not  be  run  at  low  demand  conditions  where  only  one  MFP  is  required 
and  that  pump  start  ups  should  occur  expeditiously  while  meeting  all  pump  heatup  requirements 
to  minimize  the  time  spent  at  low  unstable  flow  conditions. 


6.3.2.2.2  System  Cleanliness  Induced  Failures 

One  of  the  leading  causes,  yet  simplest  root  causes  of  failure  is  a  lack  of  system  cleanliness 
principally  in  lube  oil  or  seal  flushing  systems.  System  cleanliness  problems  were  the  root  cause 
of  MFP  failure  in  35  of  205  MFP  NPRDS  failures  which  resulted  in  a  plant  trip,  plant  shutdown, 
or  power  reduction.  While  relatively  simple  to  fix,  cleanliness  issues  require  constant  attention. 
Lube  oil  system  cleanliness  can  be  improved  through  the  use  of  filters  and  in-line  purification 
systems.  Seal  water  cleanliness  can  be  improved  through  proper  chemistry  control  and  the  proper 
pressure  and  flow  rates  to  the  seals. 


6.3.2.3  Summary  of  MFP  Root  Causes  of  Failure 

Table  6-3  provides  a  summary  of  the  major  root  causes  of  205  NPRDS  MFP  failures 
which  caused  a  plant  trip,  shutdown,  or  reduction  in  power. 

Summary  of  MFP  Root  Causes  of  Failure 
Table  6  -  3 


Root  Cause 

Number 

Vibration  Induced 

55 

Normal  Wear 

40 

Cleanliness 

35 

Human  Error 

18 

All  Others 

57 
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The  principal  recommendations  for  reducing  these  root  causes  of  failure  and  maximizing 
the  reliability  of  the  MFP  with  the  minimum  cost  include  : 

•  Maintain  system  cleanliness  in  both  lube  oil  and  seal  systems  through  daily  attention  to 
detail 

•  Reduce  vibration  by  operating  the  MFP  as  close  as  possible  to  its  Best  Efficiency  Point 

•  Perform  proper  hot  and  cold  alignments  of  the  MFP,  check  alignment  frequently 

•  Check  to  ensure  that  the  MFP  is  not  being  used  as  the  anchor  for  suction  and 
discharge  piping  and  correct  if  possible 

•  Check  to  ensure  that  the  pump  is  mounted  on  its  foundation  properly  and  that  sliding 
feet  are  lubricated 

There  are  several  other  recommendations  which  are  design  based  or  require  some  cost  to 
implement.  These  include: 

•  Install  the  proper  seals.  Balanced,  pusher,  rotating  seat  seals  with  seal  faces  of 
Antimony  filled  carbon  bearing  upon  reaction  bonded  silicon  carbide  offer  the  best 
combination  of  characterstics  for  MFP  mechanical  seals. 

•  Consider  the  installation  of  magnetic  bearings  if  the  backfit  cost  is  not  too  high. 

•  Involve  pipe  and  pump  designers  with  plant  engineers  to  reduce  nozzle  loading  to  the 
maximum  extent  possible. 

•  Consult  with  the  plant  MFP  vendor  to  establish  the  optimum  “A”  and  “B”  gap 
clearances  in  the  MFP. 

•  Tune  the  pump  impeller  to  match  the  pump  BEP  with  the  normal  plant  operating 
conditions. 

•  Ensure  plant  operating  procedures  mandate  the  optimum  combination  of  MFPs  for  the 
entire  range  of  plant  operating  conditions. 


6.4  Main  Feed  Pump  Surveillance  Program 

The  last  of  the  three  key  issues  that  must  be  addressed  in  any  overall  strategy  for  reducing 
component  or  system  forced  outage  rates  is  the  component’s  current  surveillance  program. 
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Surveillance  programs  should  be  studied  to  determine  if  the  surveillances  that  must  be  performed 
with  the  component  secured  at  intervals  less  than  48  months  directly  impact  on  the  operation  of 
the  component,  or  whether  these  surveillance’s  main  purpose  is  to  ensure  that  protective  devices 
and  alarms  for  the  component  are  functional.  In  the  first  case,  as  in  the  replacement  of  a  pump 
impeller,  these  surveillances  and  their  intervals  have  a  direct  impact  on  the  reliability  levels  and 
forced  outage  rate  contribution  of  the  component  or  system.  In  the  latter  case,  as  in  the  case  of 
the  calibration  of  the  MFP  low  suction  trip,  the  surveillance  performance  is  meant  to  aid  in 
protecting  the  component  or  system  from  severe  damage,  but  will  not  necessarily  improve  the 
overall  reliability  of  the  component.  Table  6-4  provides  a  summary  of  the  surveillances  at  the 
candidate  PWR  which  are  currently  performed  shutdown  on  the  MFP  at  intervals  less  than  48 
months.  Note  that  all  these  surveillances  have  been  previously  resolved  to  either  on-line 
performance  or  perforrnance  at  48  month  intervals  in  Chapter  3. 


Surveillances  Currently  Requiring  MFP  Shutdown 
Table  6  -  4 


Surveillditce  Description 

Reliability  or  Control 

Turbine  Bearing  Oil  and  Low  Vacuum 

Trips 

Control 

Recirculation  Flow  Indication  and  Control 

Control 

Turbine  Governor  Valve  Position 
Calibration 

Control 

36  Months 

Emergency  Oil  Pump  Pressure  Switch 
Calibration 

Control 

36  Months 

Pressure  Alarms  and  Speed  Indication 

Control 

1 8  Months 

Turbine  Trip  Header  Oil  Pressure 
Calibration 

Control 

36  Months 

Suction  Header  Pressure  Calibration 

Control 

18  Months 

Speed  Control  Calibration 

Control 

Turbine  Overspeed  Trip  Mechanism 

Check 

Control 

As  can  be  seen  from  Table  6-4,  all  the  surveillances  performed  inside  of  48  month  on  the 
MFP  at  the  candidate  PWR  are  performed  to  ensure  a  control  system  is  in  calibration.  This  does 
not  imply  that  these  surveillances  are  unimportant.  What  it  does  mean,  is  that  assuming  all  the 
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control  surveillances  remain  in  calibration,  the  pump  is  already  expected  to  run  reliably  for  at  least 
48  months  based  on  the  fact  that  there  are  no  surveillances  which  replace  or  inspect  major  MFP 
components  at  intervals  less  than  48  months.  Since  all  the  control  surveillances  listed  in  Table  6-4 
were  previously  resolved  to  a  48  month  cycle,  the  surveillance  program  supports  the  contention 
that  the  MFP  can  be  expected  to  run  reliably  for  at  least  48  months. 


6.5  Summary  of  the  Framework  for  Reducing  Forced  Outage  Rates 

This  chapter  has  developed  a  framework  for  reducing  forced  outage  rates  of  key  plant 
components  and  applied  that  framework  to  the  Main  Feed  Pump.  The  key  areas  that  must  be 
addressed  in  reducing  component  or  system  forced  outage  rates  are; 

•  Current  component  or  system  reliability  levels 

•  Major  component/system  failure  mechanisms  and  their  root  causes 

•  Current  surveillance  program’s  impact  on  overall  component  or  system  reliability 

For  the  Main  Feed  Pump,  currently  reliability  levels  were  estimated  using  both  LER  trip 
history  and  NPRDS  MFP  plant  trips,  plant  shutdowns,  and  power  reductions.  Average  outage 
times  for  outages  caused  by  MFP’s  were  obtained  from  the  NRC’s  outage  database  as  an  estimate 
of  the  average  time  to  repair  following  a  MFP  failure.  Based  on  this  data,  the  MFP  could  be 
expected  to  run  reliably  for  48  months.  This  is  further  supported  by  an  examination  of  the 
candidate  PWR’s  MFP  surveillance  program.  There  are  no  surveillances  performed  on  the  MFP 
which  replace  or  inspect  major  pump  components  at  intervals  of  less  than  48  months.  Finally,  the 
major  failure  mechanisms  and  their  root  causes  are  studied.  Several  recommendations  are 
provided  if  implemented  are  likely  to  enhance  the  current  reliability  levels  of  the  MFP. 

The  MFP  is  just  one  of  many  key  plant  components  that  must  be  studied  in  detail  to 
determine  their  individual  impact  on  the  overall  plant  forced  outage  rate.  Future  studies  should 
use  the  methodology  developed  in  this  chapter  to  focus  on  and  improve  those  systems  or 
components  which  have  the  largest  contribution  to  the  overall  plant  forced  outage  rate. 
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Chapter  7  -  Other  Fuel  Cycle  Extension  Considerations 

7.1  Introduction 

This  chapter  presents  a  number  of  mostly  managerial  issues  which  are  important 
considerations  in  achieving  a  48  month  cycle.  The  chapter  is  divided  into  three  main  sections; 
general  issues,  on-line  surveillance  performance  issues,  and  surveillance  interval  extension  issues. 


7.2  General  Issues 

7.2.1  Management 

The  top  two  priorities  of  plant  management  are  safe  and  economic  plant  performance  -  in 
that  order.  However,  in  order  to  compete  in  a  deregulating  industry,  economic  operation  has 
gone  from  a  distant  to  a  much  closer  second.  Management  must  make  nuclear  plants  cost 
competitive  or  they  will  not  survive.  The  urgency  of  the  situation  calls  for  innovative  ideas  for 
improving  plant  economic  performance.  Fuel  cycle  extension  is  such  an  idea,  but  it  is  not  an 
appropriate  strategy  for  the  poorest  performing  plants.  For  such  plants,  the  benefits  of  extended 
fuel  cycles  can  probably  not  be  realized  without  extensive  changes  in  basic  management  practices. 
Without  these  changes,  extended  cycles  are  likely  to  result  in  an  economic  penalty. 

This  hypothesis  gains  further  credence  when  one  analyzes  the  U.S.  nuclear  industry  1995 
outage  lengths.  Although  this  one  year  does  not  provide  enough  data  to  make  a  statistically 
robust  analysis,  some  interesting  observations  can  be  made  about  the  data.  For  the  purposes  of 
this  analysis,  plants  with  operating  cycles  of  greater  than  20  months  were  considered  to  have 
extended  cycle  lengths.  Assuming  that  cycle  length  has  no  impact  on  refueling  outage  lengths,  the 
plants  with  pre-outage  operating  cycles  greater  than  20  months  should  be  about  evenly  divided 
over  the  entire  spectrum  of  refueling  outage  lengths  ranging  from  23  days  (the  best)  to  152  days 
(the  worst).  In  this  one  data  set  snapshot,  this  does  not  appear  to  be  the  case.  The  data  leads  one 
to  the  conclusion  that  extended  cycle  lengths  may  have  a  correlation  with  refueling  outage  lengths 
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for  the  poorer  performing  plants  (as  measured  by  total  outage  length)  while  it  has  no  effect  on  the 
best  performing  plants.  Figure  7-1  shows  that  longer  cycle  length  plants  make  up  a  larger  than 
expected  percentage  (36%)  of  the  1/4  of  plants  with  the  shortest  outage  lengths.  But,  they  also 
make  up  a  larger  than  expected  percentage  (44%)  of  the  1/4  of  plants  with  the  longest  outage 
lengths.  Additionally,  the  average  outage  length  for  the  1/4  of  plants  with  the  longest  outage 
lengths  rises  dramatically  as  compared  to  the  rise  in  average  lengths  seen  over  the  first  three  1/4 
regions.  This  indicates  that  extending  a  plant’s  cycle  length  may  exacerbate  outage  lengths  for 
plants  with  poor  performance  records.  These  plants  would  perhaps  do  better  by  concentrating  on 
improving  performance  at  their  current  cycle  lengths  rather  than  risking  the  costs  of  an  extended 
outage  length  following  an  extended  operating  cycle. 


1995  Nuclear  Industry  Outage  Lengths 
Percent  and  Average  Outage  Lengths  of  Plants 
with  Pre-Outage  Cycle  Lengths  Greater  >20  Months 
in  each  Quarter 

Figure  7-1 


Outage  Length  Group  (Days)-  All  Plants 


While  this  data  set  is  not  large  enough  to  draw  absolute  conclusions  from,  it  does  point 
out  that  utilities  must  consider  in  advance  that  longer  run  times  may  affect  refueling  outage 
lengths  if  all  the  possible  ramifications  of  an  extended  cycle  length  are  not  considered.  In  order  to 
capture  the  benefits  of  extended  operation,  the  demands  of  high  quality  in  equipment  and 
operations  grow  rapidly. 
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Interestingly,  the  people  in  the  industry  currently  most  optimistic  about  extending  fuel 
cycles  are  those  who  are  also  managing  the  top  performing  plants.  These  people  believe  that,  in 
general,  current  plant  hardware  will  support  fuel  cycle  extension.  And  since  these  people  are 
running  plants  at  the  highest  levels  of  productivity  in  the  industry,  it  is  likely  that  they  are 
sufficiently  in  tune  with  their  systems. 

Though  they  are  not  doing  it  with  fuel  cycle  extension  specifically  in  mind,  many  of  the 
best  plants  are  already  pursuing  the  type  of  surveillance  performance  originality  necessary  to 
adopt  an  extended  fuel  cycle.  They  are  actively  looking  for  surveillances  which  can  be  performed 
on-line  and  surveillances  whose  historical  records  support  performance  interval  extension.  As  a 
result,  they  are  regularly  petitioning  the  NRC  for  line  item  technical  specification  changes.  These 
plants  recognize  that  such  pursuits  ultimately  cut  costs  regardless  of  cycle  length.  All  plants 
should  pursue  optimization  of  their  surveillance  programs. 

One  of  the  best  ways  to  optimize  a  plant’s  surveillance  program  is  through  implementation 
of  the  Improved  Standard  Technical  Specifications  (ISTS).  In  most  cases,  the  ISTS’s  will  result 
in  fewer  required  surveillances.  Just  as  important,  the  use  of  the  ISTS  will  ensure  timely  NRC 
response  when  changes  are  requested  to  the  technical  specifications. 

7.2.2  Modes  of  Transition 

This  thesis  proposes  a  strategy  for  achieving  a  48  month  fuel  cycle.  The  48  month  interval 
was  chosen  because  it  was  within  practical  core  load  limits  and  yet  is  significantly  longer  than  any 
cycle  currently  employed  or  currently  contemplated  within  the  U.S.  nuclear  industry.  One  of  this 
thesis’s  primary  objectives  was  to  prove  that  the  regulatory  barriers  to  an  extended  fuel  cycles 
could  be  overcome.  However,  the  best  method  of  achieving  a  48  month  cycle  is  probably  not  in 
one  abrupt  fuel  cycle  extension,  but  rather  in  incremental  changes  from  24  to  36  to  48  months. 

From  an  engineering  standpoint  it  is  probably  more  prudent  to  adopt  a  48  month  operating 
cycle  incrementally  since  the  long  term  operating  performance  of  many  major  plant  components  in 
the  interval  between  24  and  48  months  is  not  well  understood.  By  increasing  cycle  lengths 
incrementally,  data  on  longer  term  operating  performance  and  failure  mechanisms  can  be 
gathered.  With  this  data,  maintenance,  design,  and  operating  strategies  to  support  longer 
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operating  cycles  can  then  be  developed.  While  abrupt  transitions  may  be  possible,  a  gradual 
transition  to  an  extended  cycle  length  is  much  more  likely  to  be  successful. 


7.2.3  Mid-Cycle  Maintenance  Outages  &  Surveillance  Performance  Hotlists 

The  age  and  physical  condition  of  some  systems  at  some  plants  will  create  obstacles  to  a 
48  month  operating  cycle.  If  a  surveillance  is  important  economically  in  terms  of  the  Limiting 
Plant  Event  Frequency  (LPEF),  and  cannot  be  performed  either  on-line  or  shutdown  at  48  month 
intervals,  a  plant  may  need  to  shut  down  during  the  operating  cycle  to  perform  the  surveillance. 
Chapter  4  provided  a  list  of  surveillances  which  are  likely  to  fall  into  this  category.  Of  these, 

Steam  Generator  Eddy  Current  testing  and  ESFAS  testing  take  the  longest  to  perform  and  are 
candidates  for  performance  during  a  mid-cycle  maintenance  outage.  Based  on  historical  records, 
this  mid-cycle  outage  is  estimated  to  take  on  the  order  of  10-14  days. 

Although  it  may  be  necessary,  a  planned  mid-cycle  maintenance  outage  erodes  the 
capacity  factor  gains  which  are  the  impetus  to  the  entire  extended  fuel  cycle  project,  and  should 
be  avoided  if  possible.  As  an  alternative,  plants  should  be  prepared  to  use  reduced  power 
windows  or  forced  outages  to  accomplish  Category  C  type  surveillances  as  long  as  the 
surveillance  performance  does  not  unnecessarily  extend  the  forced  outage  length.  Since  it 
typically  takes  a  plant  about  two  to  three  days  to  recover  from  a  forced  outage,  there  should  be 
plenty  time  to  complete  the  Category  C  surveillances  identified  in  Chapter  4,  with  the  exception  of 
ESFAS  testing  and  Steam  Generator  Eddy  Current  testing,  if  they  have  been  pre-planned  and  can 
be  started  within  a  couple  of  hours  notice  of  a  forced  outage.  Given  that  the  current  cycle  length 
record  is  less  than  700  days,  forced  outage  windows  are  likely  to  be  available  for  most  of  the 
Category  C  surveillances. 

As  a  concluding  thought,  as  Chapter  3  shows,  only  54  of  the  3108  surveillances  evaluated 
pose  potential  barriers  to  a  48  month  fuel  cycle. 
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7.2.4  Odd  Length  Surveillance  Intervals  Greater  Than  Target  Cycle  Length 

A  relatively  minor  issue,  but  one  that  can  easily  be  overlooked,  is  that  of  odd  length 
surveillance  intervals.  Odd  length  surveillances,  are  those  surveillances  performed  shutdown, 
whose  current  performance  intervals  are  longer  multiples  of  the  current  cycle  length,  but  whose 
performance  intervals  would  not  be  multiples  of  an  extended  cycle  length.  For  example,  an 
electrical  surveillances  is  currently  performed  every  72  months  which  is  a  multiple  of  the  current 
cycle  length  of  18  months.  If  the  cycle  length  is  changed  to  48  months,  a  decision  must  be  made 
as  to  whether  to  perform  the  surveillance  more  frequently  at  48  month  intervals  or  attempt  to 
technically  justify  extending  the  MOV  performance  interval  to  96  months.  Both  options  have 
potential  benefits  and  drawbacks,  although  96  months  would  obviously  be  a  better  goal  so  that  the 
surveillance  would  not  have  to  be  performed  every  refueling  outage.  Another  reason  to  aim  for 
the  96  month  performance  interval  is  that  some  surveillances  (such  as  operability  tests  of  safety 
system  motors)  ultimately  decrease  component  life  expectancy  because  of  the  added  wear 
resulting  from  surveillance  performance.  Consequently,  somewhere  in  the  fuel  cycle  transition 
process,  engineering  attention  needs  to  be  given  to  surveillances  with  odd  length  performance 
intervals.  The  total  number  of  surveillances  with  odd  length  surveillance  intervals  greater  than  48 
months  are  identified  in  Chapter  3. 


7.2.5  Radiation  Exposure 

Adopting  a  four  year  operating  cycle  may  have  an  effect  on  the  radiation  exposure 
received  by  plant  personnel.  The  yearly  collective  dose  received  from  refueling  outages  will  tend 
to  decrease  since  the  interval  between  refuelings  will  be  extended  and  the  number  of  surveillances 
performed  during  refueling  outages  will  be  reduced.  However,  increasing  the  number  of 
surveillances  performed  on-line  may  increase  the  total  collective  dose  since  general  area  radiation 
levels  are  higher  with  the  plant  at  power. 

As  an  example  of  the  possible  changes  in  radiation  dose  from  an  extended  cycle,  the 
following  data  was  taken  from  a  local  BWR: 
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24  Month  BWR  Radiation  Data 


Table  7-  1 


Categoiy 

Dose 

Refueling  portion  of  the  last  outage 

69  man  rem 

Non-refiieling  portion  of  the  last  outage 

321  man-rem 

Annual  collective  dose  excluding  refueling 
outages 

100  man-rem 

Average  annual  collective  dose  over  24  months 

300  man-rem  [(69+321+(2*100))/2 

To  compare  the  24  month  surveillance  program  average  annual  collective  radiation  dose 
to  a  possible  48  month  surveillance  program  the  following  assumptions  were  made: 

1 .  General  area  radiation  levels  during  on-line  operations  are  about  twice  those  shutdown. 

2.  Half  of  the  surveillances  currently  performed  shutdown  will  be  performed  on-line  and  half  will 
continue  to  be  performed  during  shutdowns  with  the  shutdown  exposure  half  the  on-line 
exposure. 

3.  There  will  be  a  25%  increase  in  refueling  operation  dose  due  to  a  loss  of  proficiency  from 
performing  refueling  operations  once  every  48  months  as  compared  to  24  months. 

4.  The  average  annual  collective  dose  excluding  refueling  outages  will  remain  unchanged. 

Using  these  thumbrules,  the  approximate  average  annual  collective  dose  from  a  48  month 
cycle  would  be  as  follows: 


Estimated  48  Month  BWR  Exposure 
Table  7-  2 


Category 

Dose 

Average  annual  collective  dose  excluding  refueling  outages  (4  years) 

400  man-rem 

Refueling  operations  exposure  (69  man-rem  +25%) 

86  man-rem 

Non-refueling  outage  exposure  (321/2) 

160  man-rem 

Non-refueling  outage  exposure  shifted  on-line  (321/2)*2  general  area) 

320  man-rem 

Total  collective  dose  for  a  48  month  cycle  (Sum  of  1st  four) 

966  man-rem 

Average  annual  collective  dose  for  a  48  month  cycle  (966/4) 

242  man-rem 
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These  values  are  rough  estimates  and  will  change  depending  on  the  assumptions  used, 
most  notably  the  on-line  general  area  radiation  levels  and  the  refueling  operation  dose.  However, 
the  rough  estimates  demonstrate  that  a  drop  in  radiation  exposure  is  possible  from  an  extended 
fuel  cycle  and  are  within  the  INPO’s  goals  for  annual  collective  dose  (250  man  rem  for  a  BWR  by 
the  year  2000).  Relative  changes  in  the  dose  estimates  from  a  PWR  should  be  considerably 
smaller. 


7.2.6  Integrated  Outage  Teams 

One  of  the  concepts  being  looked  at  by  the  company  which  owns  the  candidate  PWR  is 
the  use  of  integrated  outage  teams  to  reduce  maintenance  costs.  In  this  concept,  experts  in 
particular  fields  are  looked  upon  as  resources  for  a  series  of  plants  within  a  network,  as  opposed 
to  experts  for  one  particular  plant  only.  In  this  way,  an  expanded  talent  pool  is  available  to 
address  problems  within  the  utility.  Lessons  learned  and  experience  gained  from  one  plant  can  be 
applied  to  other  plants  within  the  company  to  improve  the  performance  of  all  the  plants. 
Additionally,  in  an  era  of  downsizing,  having  experts  available  for  all  plants  within  a  utility  means 
that  the  total  workforce  can  be  reduced.  Integrated  outage  teams  are  particularly  well  suited  for 
complex  outage  evolutions  such  as  refueling  operations  or  steam  generator  eddy  current  testing. 


7.3  On-Line  Performance  Issues 

7.3.1  Risk  Monitors 

On-line  risk  monitoring  software  such  as  Sentinel  and  Equipment  Out  of  Service  (EOOS) 
are  being  incorporated  throughout  the  nuclear  industry.  These  monitors  are  Probabilistic  Risk 
Assessment  (PRA)  based  tools  which  help  to  quantify  the  increased  risks  involved  with  taking 
systems  and  combinations  of  systems  out  of  service  while  the  plant  is  operating.  Although  not  all 
U.S.  plants  are  employing  well  developed  risk  monitors,  risk  monitors  will  undoubtedly  play  a 
role  in  the  safe  performance  of  the  extensive  on-line  testing  and  maintenance  activities  needed  to 
achieve  a  four  year  operating  cycle. 
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Plant  risk  monitors  are  developed  and  maintained  by  PRA  engineers.  They  are  designed 
for  use  by  both  surveillance  schedulers  and  plant  operators.  The  monitors  enable  surveillance 
schedulers  to  quantify  the  risks  involved  with  performing  one  or  more  maintenance  or  testing 
activities  in  a  given  plant  mode.  The  schedulers  can  then  optimize  work  schedules  by  managing 
the  risk  associated  with  the  different  activities.  For  the  operator,  the  risk  monitors  identify  which 
systems  are  most  important  to  maintain  operable  given  that  another  system  is  inoperable.  For 
example,  if  a  emergency  diesel  generator  is  taken  off-line,  a  risk  monitor  would  tell  the  operator 
what  the  overall  increased  risk  is  in  terms  of  the  Core  Damage  Frequency  (CDF)  and  would 
identify  the  steam  driven  Emergency  Feedwater  Pump  as  the  most  valuable  safety  system  which 
should  be  maintained  operable. 

Although  PRA  based  risk  tools  which  emphasize  CDF  are  well  developed,  more  effort 
must  be  concentrated  on  an  economic  Limited  Plant  Event  Frequency  (LPEF)  tool.  This  tool 
would  be  an  economics  based  PRA  tool  and  include  CDF  as  one  of  the  limiting  plant  events 
because  of  its  enormous  economic  impact.  It  could  function  as  both  an  on-line  monitor  for 
operators  to  use  and  as  a  more  detailed  stand  alone  tool  for  planners  to  use  when  developing  the 
entire  surveillance  program  for  a  48  month  fuel  cycle.  The  possible  inputs  and  methodology  for  a 
PRA  based  economic  LPEF  tool  are  discussed  in  more  detail  in  chapter  2. 


7.3.2  NRC  Perspective 

The  NRC  supports  the  concept  of  on-line  surveillance  performance  and  recognizes  its 
importance  to  the  economic  competitiveness  of  the  nuclear  industry.  In  contrast  to  refueling 
outages,  more  attention  can  be  focused  on  the  safe  performance  of  on-line  surveillances  because 
there  are  not  as  many  activities  competing  for  the  time  and  attention  of  plant  personnel.  In 
addition  to  the  extra  oversight  and  attention  to  detail  which  can  be  given  to  on-line  surveillances 
performance,  it  is  safer  to  perform  some  surveillances  on-line.  One  example  is  the  Residual  Heat 
Removal  (RHR)  system.  The  system  is  not  required  with  the  plant  at  power.  However,  during 
refueling  operations  it  is  a  vital  decay  heat  removal  source.  Because  of  this,  it  is  more  risk 
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significant  when  the  plant  is  shutdown  than  when  the  plant  is  operating.  Therefore,  RHR 
surveillances  are  safer  if  performed  at  power. 

Probably  the  major  concern  the  NRC  has  with  on-line  surveillance  performance  is  that 
plant  personnel  often  do  not  have  a  firm  understanding  of  the  consequences  and  possible 
contingencies  required  when  a  particular  system  is  removed  from  service.  To  avoid  this,  plant 
management  must  instill  the  proper  safety  culture  and  take  an  active  role  in  ensuring  that  all 
workers  are  thoroughly  prepared  prior  to  on-line  surveillance  performance. 


7.3.3  Degradation  from  Over-Testing 

The  possible  negative  effects  of  increasing  surveillance  performance  frequency  for  a 
surveillance  which  can  now  be  performed  on-line  must  be  carefully  understood.  Surveillance 
performance  frequency  should  not  be  arbitrarily  increased.  For  example,  human  errors  introduced 
during  surveillance  performance  can  cause  a  system  which  was  performing  well  to  experience 
problems  upon  return  to  operational  status.  Consequently,  a  thorough  justification  in  terms  of 
either  LPEF  or  CDF  should  be  made  before  increasing  a  surveillance’s  frequency.  Poorly  planned 
frequency  increases  could  ultimately  result  in  increases  in  either  the  LPEF  or  CDF. 


7.4  Performance  Interval  Extension  Issues 

7.4.1  Quantification  of  Extension  Justifications  and  Data  Availability 

The  NRC’s  Generic  Letter  91-04  identifies  the  documentation  required  to  extend  technical 
specification  surveillance  intervals  to  24  months.  In  order  to  extend  the  calibration  interval  on 
instrumentation,  a  utility  must  present  a  detailed,  quantified  justification  “in  order  to  confirm  that 
drift  will  not  result  in  instrument  errors  that  exceed  the  assumptions  of  the  safety  analysis.” 
However,  non-instrumentation  surveillances  requirements  for  interval  extension  justification  are 
not  as  quantitative  and  can  be  based  heavily  on  past  material  history  and  expert  judgment.  In 
addition  to  ensuring  that  the  increased  interval  does  not  invalidate  any  assumption  in  the  plant 
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licensing  basis,  the  NRC  requires  that  historical  maintenance  and  surveillance  data  be  checked  to 
be  sure  that  such  records  validate  the  expert  opinion.  In  fact,  Generic  Letter  91-04  states  that 
utilities  “need  not  quantify  the  effect  of  the  change  in  surveillance  intervals  on  the  availability  of 
individual  systems  or  components.” 

One  of  the  likely  reasons  for  not  requiring  a  more  quantified  approach  to  performance 
interval  extension  justifications  is  the  lack  of  solid  data  upon  which  to  make  quantitative 
judgments.  The  data  deficiency  is  a  problem  in  many  sectors  of  the  nuclear  utility  industry. 
Ultimately,  the  lack  of  data  availability  and  trending  is  a  problem  which  can  be  solved  if  given  a 
high  enough  priority  by  management.  Since  it  is  reasonable  to  assume  that  expert  judgment  will 
not  be  sufficient  to  justify  every  non-instrumentation  surveillance  out  to  48  months,  this  is  a 
problem  which  must  be  solved  if  a  four  year  cycle  is  to  become  a  reality. 

7.4.2  Insurance  Costs  and  Vendor  Guarantee  Issues 

Extending  the  interval  between  testing  of  some  plant  components  may  have  an  impact  on 
the  cost  of  insurance  to  the  industry.  Initial  conversations  with  the  Nuclear  Mutual  Limited 
(NML)^^  indicate  that  from  a  regulatory  standpoint,  that  as  long  as  the  NRC  agrees  with  the 
changes  necessary  to  obtain  a  48  month  fuel  cycle,  that  no  rate  changes  would  occur  on  the 
systems  under  the  responsibility  of  the  NRC.  On  the  Balance  of  Plant  (BOP)  side,  NML  has 
developed  loss  control  standards,  agreed  upon  by  the  industry,  which  detail  the  required 
inspections  and  performance  intervals  for  all  major  pieces  of  equipment.  This  includes  such  items 
as  the  Main  Turbine  and  Main  Feed  Pumps.  As  long  as  the  current  inspection  interval  for  these 
major  components  is  greater  than  48  months  they  will  not  have  an  impact  on  the  insurance  rates 
charged  the  utilgy.  Any  components  with  inspection  intervals  inside  of  48  months  will  have  to  be 
studied  further  to  determine  any  changes  in  the  insurance  rates  charged  a  utility. 


Phone  conversation  between  Thomas  Moore,  MIT,  and  Greg  Wilks,  NML,  of  1  May  1996. 


197 


7,5  Summary 

This  chapter  presents  a  few  of  the  many  issues  that  must  be  considered  prior  to 
implementing  an  extended  tuel  cycle  program.  The  main  purpose  of  the  chapter  was  to  point  out 
that  even  if  technically  feasible,  the  benefits  of  extended  fuel  cycles  will  depend  just  as  much,  if 
not  more,  on  a  proactive  and  forward  thinking  managerial  approach  to  the  myriad  of  issues  that 
must  be  properly  addressed  to  successfully  implement  an  extended  fuel  cycle  program.  Many  of 
the  issues  discussed  here  also  have  applicability  to  improved  economic  performance  regardless  of 
cycle  length.  Ultimately,  strong  management,  and  excellent  operational  and  maintenance  teams 
-  will  be  the  key  factors  in  whether  the  48  month  fuel  cycle  will  provide  the  economic  benefits 
touted  here. 
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Chapter  8  Summary  and  Future  Work 


8.1  Summary 

Heading  into  the  21st  century  the  U.S.  nuclear  industry  must  be  willing  to  expand 
the  goal  of  each  plant  from  safe  performance,  to  safe  and  economic  performance,  and 
apply  this  type  of  thinking  in  all  its  decision  making  processes  if  it  hopes  to  remain 
competitive  in  a  deregulated  electric  power  market.  This  thesis  has  focused  on  improving 
plant  economic  performance  by  developing  a  strategy  for  increasing  plant  cycle  lengths  to 
48  months  or  more.  The  strategy  addressed  the  key  issues  of  matching  the  current 
regulatory  and  investment  protection  surveillance  programs  to  a  48  month  cycle,  and 
determining  the  impact  of  48  month  cycles  on  component  reliability  and  overall  plant 
forced  outage  rates. 

The  goals  and  objectives  of  the  thesis  were  to: 

•  Overcome  the  regulatory  and  investment  protection  barriers  to  extended  cycle  lengths 

•  Provide  a  systematic  surveillance  resolution  procedure  that  utilities  can  use  to  prepare 
for  extended  cycle  lengths 

•  Develop  an  initial  framework  for  a  key  plant  component  to  demonstrate  how  key  plant 
components  can  operate  for  extended  periods  of  time  between  maintenance  without 
adversely  impacting  the  plant  forced  outage  rate. 

The  first  step  in  meeting  the  stated  goals  and  objectives  of  the  thesis  was  to 
develop  a  detailed  methodology  for  resolving  the  current  regulatory  and  investment 
protection  surveillance  programs  to  a  48  month  cycle.  The  methodology  produced 
recommendations  for  each  surveillance  regarding  its  compatibility  to  a  48  month  fuel 
cycle.  The  three  major  categories  of  recommendations  were: 

•  Category  A  Surveillance  -  A  candidate  for  on-line  performance. 
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•  Category  B  Surveillance  -  A  candidate  for  performance  interval  extension  to  48 
months. 

•  Category  C  Surveillance  -  A  potential  barrier  to  a  48  month  cycle  requiring  further 
study. 

As  part  of  this  methodology  an  economic  optimization  model  was  developed.  The 
purpose  of  the  economic  optimization  model  was  to  recognize  that  many  surveillances  fit 
into  both  the  on-line  performance  and  extended  interval  performance  categories,  and  that 
there  is  an  optimum  mix  of  these  surveillances  which  produces  maximum  economic  benefit 
while  maintaining  current  plant  risk  levels.  The  economic  optimization  model  also 
introduced  the  concept  of  the  Limiting  Plant  Event  (LPE).  LPE’s,  which  include  all 
events  with  a  significant  economic  impact,  define  the  entire  set  of  risks  which  must  be 
controlled  to  achieve  economic  success.  Since  the  rationale  behind  any  length  fuel  cycle 
extension  program  is  improved  economic  performance,  the  LPE  frequency  is  the  critical 
factor  that  must  be  considered  in  any  surveillance  resolution  program. 

To  meet  the  first  two  stated  goals  and  objectives  of  the  thesis,  the  surveillance 
resolution  methodology  was  applied  to  the  regulatory  and  investment  protection 
surveillance  programs  at  an  operating  Pressurized  Water  Reactor  (PWR).  All 
surveillances  which  were  currently  precluding  a  48  month  fuel  cycle  were  considered.  Of 
the  3,108  surveillances  currently  performed  shutdown  at  intervals  less  than  48  months, 
2,673  are  likely  candidates  for  on-line  performance,  381  are  likely  candidates  for 
performance  interval  extension  to  48  months,  and  54  remain  as  likely  barriers  to  a  48 
month  fuel  cycle.  Of  the  2,673  surveillances  which  are  candidates  for  on-line 
performance,  67  require  a  reduced  power  window  for  on-line  performance.  Performance 
of  these  surveillances  during  a  reduced  power  window  is  likely  to  produce  a  net  economic 
benefit  as  compared  to  the  shutdown  performance  option,  if  shutdown  performance  of 
these  surveillances  takes  more  than  2.9  days.  A  recommended  performance  sequence  for 
these  reduced  power  window  surveillances  and  economic  analysis  is  included. 

The  54  surveillances  which  are  potential  barriers  to  an  extended  fuel  cycle 
(Category  C)  are  evenly  divided  between  the  regulatory  and  investment  protection 
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surveillance  programs.  On  the  regulatory  side,  several  motor-operated  safety  injection 
valves  and  steam  generator  eddy  current  testing  are  potential  barriers  to  a  48  month  fuel 
cycle.  On  the  investment  protection  side,  condenser  waterbox  maintenance  and  several 
reactor  coolant  pumps  surveillances  also  pose  likely  barriers  to  a  48  month  fuel  cycle. 
Relief  valve  testing  is  a  common  regulatory  and  investment  protection  surveillance  barrier 
to  extended  cycles.  Based  on  a  review  of  historical  performance  times,  the  Category  C 
surveillances  require  about  12-14  days  to  complete  with  the  plant  shutdown. 

As  part  of  an  actual  PWR  24  month  fuel  cycle  extension  program,  a  technical 
justification  for  extending  the  testing  interval  of  the  Primary  Component  Cooling  Water 
(PCCW)  from  18  to  24  months  was  developed.  Additionally,  as  part  of  this  effort, 
detailed  instructions  for  the  completion  of  technical  evaluations  suitable  for  submission  to 
the  Nuclear  Regulatory  Commission  (NRC)  were  drafted.  Both  are  included  in  this  thesis 
to  demonstrate  the  level  of  effort  required  to  perform  a  complete  48  month  fuel  cycle 
surveillance  resolution  project. 

To  meet  the  final  goal  and  objective  of  the  thesis,  a  three  part  methodology  was 
developed  for  studying  the  impact  of  key  plant  components  on  the  overall  plant  forced 
outage  rate.  The  thesis  forced  outage  rate  goal  was  derived  from  the  current  Institute  for 
Nuclear  Power  Operations  (INPO)  forced  outage  rate  goal  of  less  than  3%.  The 
methodology  for  studying  key  plant  components  involved; 

•  Determining  the  current  component  or  system  reliability  levels 

•  Determining  the  major  component/system  failure  mechanisms,  the  root  causes 
of  failure,  and  providing  recommendations  for  their  correction 

•  Determining  the  current  surveillance  program’s  impact  on  overall  component 
or  system  reliability 

The  methodology  was  first  applied  to  the  Main  Feed  Pump  (MFP).  The  MFP  was 
chosen  because  of  its  relative  simplicity,  access  to  pump  experts,  and  the  availability  of 
some  actual  failure  rate  data.  Using  data  obtained  from  a  review  of  Licensee  Event 
Reports  (LER)  and  the  Nuclear  Plant  Reliability  Data  System  (NRPDS)  MFP  failure  rates 
of  6.46*  1 0‘Vhr  and  1.57*  1 0'Vhr  respectively  were  calculated.  When  combined  with  an 
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estimated  average  time  to  repair  of  53  hours  obtained  from  a  review  of  the  NRC 
maintained  industry  outage  database,  both  the  LER  and  NPRDS  derived  failure  rates  were 
well  under  the  calculated  failure  rate  of  3*  lO'^hr  needed  to  achieve  a  system  97% 
capacity  factor. 

The  major  MFP  failure  mechanisms  and  their  root  causes  were  determined  based 
on  a  review  of  feed  pump  failure  data  and  extensive  interviews  with  industry 
representatives,  pump  consultants,  pump  vendors,  and  major  sub-component  vendors. 

The  major  causes  of  MFP  failures  were  the  seals,  bearings,  pump  structures,  and  the  speed 
control  systems.  The  major  root  causes  of  these  failures  were  vibration,  system 
cleanliness,  and  improper  system  design. 

The  current  surveillance  program  at  the  candidate  PWR  was  reviewed  to 
determine  its  impact  on  MFP  reliability  and  the  MFP  contribution  to  the  overall  plant 
forced  outage  rate.  All  surveillances  performed  at  frequencies  of  less  than  48  months 
involved  the  testing  of  various  MFP  trips,  alarms,  and  speed  control  systems.  These  types 
of  surveillances  are  designed  to  prevent  damage  to  the  MFP  from  abnormal  plant 
conditions,  but  in  general  do  not  contribute  to  the  overall  reliability  levels  of  the  pump. 

All  surveillances  which  inspected  or  replaced  major  MFP  components  such  as  bearings, 
seals,  or  impellers,  which  would  affect  the  long  term  reliability  of  the  MFP  are  performed 
at  intervals  greater  than  48  months.  Based  on  the  review  of  the  MFP  surveillance  program 
in  conjunction  with  the  calculated  failure  rates  and  failure  mechanism  review,  it  was 
concluded  that  the  MFP  could  be  expect  to  operate  reliably  on  a  48  month  fuel  cycle 
without  adversely  impacting  the  overall  plant  forced  outage  rate. 

Finally,  many  of  the  important  managerial  issues  related  to  extended  cycles  were 
studied.  One  of  the  most  significant  findings  was  that  there  appears  to  be  a  relationship 
between  operating  cycle  length  and  the  subsequent  refueling  outage  length.  Plants  that 
had  operating  cycles  greater  than  20  months  tended  to  be  either  amongst  the  25%  of 
plants  with  the  shortest  refueling  outage  lengths  or  in  the  25%  of  plants  with  the  longest 
refueling  outage  lengths.  This  leads  to  the  conclusion  that  the  best  performing  plants  will 
tend  to  receive  the  greatest  economic  benefit  from  an  extended  fuel  cycle,  while  the  worst 
performing  plants  may  actually  incur  an  economic  penalty  by  extending  their  cycle  lengths. 
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The  worst  performing  plants  should  concentrate  on  improving  their  performance  at  their 
current  cycle  length  before  considering  moving  to  an  extended  cycle  length. 

8.2  Future  Work 

As  a  result  of  some  of  the  findings  of  this  thesis,  there  is  significant  future  work 
that  must  be  accomplished  by  the  MIT  Extended  Fuel  Cycle  project  to  establish  the 
technical  basis  upon  which  a  utility  decision  to  explore  implementing  an  extended  fuel 
cycle  could  be  based.  The  future  work  includes  a  wide  range  of  areas  from  economics  to 
plant  safety. 

Chapter  2  (Surveillance  Resolution  Methodology)  introduced  the  concept  of  an 
Economic  Optimization  Model  and  the  Limiting  Plant  Event  Frequency  (LPEF)  as  tools  in 
making  economic  decisions.  Actual  development  of  this  model  using  modern  linear 
programming  and  probabilistic  risk  assessment  techniques  should  be  investigated.  Further 
research  should  also  be  considered  on  quantifying  the  LPEF  and  the  impact  of  plant 
configuration  changes  on  the  LPEF.  This  work  should  be  similar  in  scope  to  previous 
work  done  on  Core  Damage  Frequency  (CDF)  such  as  in  the  RISKMAN  software.  Since 
CDF  is  only  a  subset  of  the  entire  set  of  LPE’s,  developing  this  tool  will  require  significant 
time  and  resources. 

Chapter  3  (Surveillance  Categorization)  qualitatively  applied  the  methodology 
developed  in  Chapter  2  to  determine  the  optimum  performance  mode  of  each  surveillance. 
As  part  of  this  effort,  research  must  be  conducted  on  developing  a  quantitative  method  for 
determining  the  optimum  performance  interval  for  all  surveillances.  Determining  the 
optimum  performance  interval  for  both  the  surveillances  that  can  be  performed  on-line  and 
those  that  must  be  performed  shutdown  will  improve  economic  performance  by  reducing 
the  amount  of  maintenance  that  must  be  performed.  Reducing  the  amount  of  maintenance 
performed  is  also  likely  to  result  in  an  additional  reliability  payoff  by  reducing  the  impact 
of  human  error  on  component  reliability. 

Chapter  4  (Category  C  Surveillances)  provided  a  complete  description  of  the  54 
individual  surveillances  identified  as  potential  barriers  to  a  48  month  cycle.  Some  possible 
solutions  to  these  surveillance  barriers  were  proposed.  However,  more  detailed 
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engineering  work  needs  to  be  done  on  each  of  these  surveillances.  The  detailed 
engineering  work  should  propose  a  range  of  possible  solutions  utilizing  existing  and 
evolving  state-of-the-art  technologies.  All  engineering  solutions  must  consider  the  cost  of 
implementing  the  proposed  changes. 

Chapter  6  (A  Framework  for  Reducing  Forced  Outage  Rates)  proposed  a 
framework  for  reducing  plant  forced  outage  rates.  One  of  the  key  factors  in  prioritizing 
those  components  which  should  be  studied  first  is  the  availability  and  accuracy  of 
component  failure  rate  data.  Several  databases  of  data  exist  such  as  the  Licensee  Event 
Reports  (LER),  Nuclear  Plant  Reliability  Data  System  (NPRDS),  and  the  NRC’s  “gray 
book”  which  keeps  track  of  industry  wide  outages  and  their  causes.  These  databases  need 
to  be  normalized  so  that  the  data  sources  are  compatible  with  each  other.  Only  by 
developing  consistency  amongst  the  data  sources  can  accurate  conclusions  be  drawn. 
Additional  sources  of  data  must  continue  to  be  pursued.  With  the  data  currently  available, 
future  work  should  study  the  prioritized  component  list  and  develop  recommended 
solutions  for  reducing  forced  outage  rates.  The  goal  of  the  each  study  should  be  to  reduce 
any  time  dependent  component  of  failure  over  a  48  month  cycle  interval. 

Additional  research  should  also  continue  on  some  of  the  more  subtle  management 
issues  that  must  be  addressed  in  order  to  make  a  smooth  transition  from  current  operating 
lengths  to  an  extended  operating  cycle.  A  closer  examination  of  the  impact  of  cycle 
lengths  on  the  nuclear  industry’s  insurance  rates  must  be  conducted. 

Finally,  a  detailed  economic  analysis  must  be  performed  that  incorporates  the  costs 
of  an  extended  cycle  core  with  the  potential  operations  and  maintenance  savings  from 
extended  cycle  operations.  Only  if  the  nuclear  industry  is  convinced  that  there  is  a  short 
term  (three  to  four  year)  payoff  of  an  extended  cycle  core  will  extended  cycle  lengths  ever 
be  seriously  studied  for  adoption. 
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Appendix  A  Instructions  for  Technical  Evaluations 


Instructions  for  Completion  of 
Fuel  Cycle  Extension 
Technical  Evaluations 


A.l  Introduction 

The  purpose  of  the  technical  evaluation  is  to  provide  a  technical  justification  to  the 
Nuclear  Regulatory  Commission  for  extending  the  performance  interval  of  a  surveillance 
in  support  of  a  fuel  cycle  extension  project.  This  instruction  outlines  the  methodology 
necessary  to  meet  the  requirements  of  NRC  Generic  Letter  91-04  “Changes  in  Technical 
Specification  Surveillance  Intervals  to  Accommodate  a  24-Month  Fuel  Cycle”  and  is 
adaptable  to  fuel  cycles  of  various  lengths.  All  personnel  performing  technical  evaluations 
should  read  and  be  familiar  with  the  requirements  of  Generic  Letter  91-04  before 
attempting  to  complete  a  technical  evaluation. 

For  all  evaluations,  the  evaluator  must  demonstrate  the  following: 

•  The  effect  on  plant  safety  is  insignificant,  and; 

•  Historical  preventative  and  corrective  maintenance  records,  surveillance  data,  and 
other  surveillances  performed  on  system  components  support  this  conclusion,  and; 

•  The  performance  of  the  surveillance  at  the  bounding  surveillance  interval  limit  will  not 
invalidate  any  assumption  in  the  plant  licensing  basis. 

Generic  Letter  91-04  also  addresses  specific  information  that  is  required  for  surveillances 
involving  Steam  Generator  inspections  (PWR  only),  containment  leak  tests,  and 
instrument  drift.  Evaluators  involved  with  surveillances  in  these  particular  areas  must 
ensure  they  understand  any  additional  Generic  letter  requirements  they  must  address  in 
their  evaluation. 
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A.2  Methodology 

Section  8.2.2  of  this  report  is  a  technical  evaluation  completed  for  PWR  technical 
specification  4.7.3.b.  “Primary  Component  Cooling  (PCC)  Automatic  Valve  Actuation”. 

It  provides  a  general  format  for  technical  evaluations  suitable  for  submission  to  the  NRC. 
A  more  detailed  discussion  of  each  section  of  the  technical  evaluation  follows. 

A.2.1  Section  I  -  Technical  Evaluation  Conclusion 

State  the  current  technical  specification  frequency  and  whether  or  not  the 
surveillance  will  support  performance  interval  extension.  If  the  evaluation  supports 
extension  of  the  surveillance  interval,  the  wording  of  this  paragraph  should  closely  follow 
the  wording  shown  in  section  8.2.2  which  is  derived  from  Generic  Letter  91-04. 

A.2.2  Section  II  -  Description  of  Change 

Briefly  describe  the  surveillance  being  evaluated  and  the  individual  components 
being  tested  if  applicable.  Individual  components  tested  should  be  added  as  an  attachment 
to  the  base  report.  The  plant’s  Final  Safety  Analysis  Report  (FSAR)  provides  an  excellent 
reference  description  of  the  system  and  components  involved  in  the  evaluation.  A 
description  of  the  change  requested  to  the  current  technical  specification  should  follow. 

A.2.3  Section  DA  -  Open  Items  Section 

During  the  course  of  the  evaluation,  identify  any  potential  conflicts  with  current 
operations  or  maintenance  practices  that  would  result  from  extending  a  surveillance 
performance  interval.  For  instance,  the  PWR  technical  evaluation  of  section  8.2.2, 
performed  on  the  PCC  automatic  valve  surveillance,  clearly  supported  extending  the 
performance  interval  from  1 8  to  24  months.  However,  during  the  course  of  the 
evaluation,  several  maintenance  items  currently  performed  at  multiples  of  1 8  months 
(36,48,etc.)  were  identified  which  will  have  to  be  evaluated  to  determine  the  optimum 
performance  interval  consistent  with  a  24  month  cycle  (24,  48,  72,  etc.).  MOV’s  for 
example  are  lubricated  every  36  months.  Half  of  the  valves  are  lubricated  every  18 
months  to  balance  the  work  load.  If  it  is  not  possible  to  extend  the  current  performance 
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interval  for  lubrication  from  36  to  48  months,  than  the  lubrication  performance  interval 
may  have  to  be  shortened  to  24  months  and  all  MOV’s  lubricated  every  outage.  This  may 
impact  the  length  of  the  refueling  outage  and  negate  any  benefits  gained  from  transitioning 
to  a  24  month  fuel  cycle  when  the  total  surveillance  package  is  considered.  This  is  an  in 
house  section  to  be  used  by  the  fuel  cycle  extension  coordinator.  Once  the  potential 
conflicts  are  resolved  this  section  should  be  deleted  prior  to  submission  to  the  NRC. 

A.2.4  Section  III  -  Evaluation  of  Change 

This  is  the  most  important  section  of  the  evaluation  and  forms  the  basis  for  the 
evaluation  final  conclusions.  There  are  two  major  parts  to  this  section,  a  potential  system 
failure  mode  analysis  to  analyze  possible  problems  that  might  occur  beyond  the  current 
performance  interval,  and  a  review  of  the  system/component  past  performance  history. 

The  methodology  needed  to  complete  each  section  is  described  in  more  detail  below.  A 
checklist  is  included  at  the  end  of  this  instruction  to  assist  in  performing  this  section. 

A.2.4.1  Potential  System  Failure  Modes 

Evaluate  the  following  areas: 

•  What  is  the  purpose  of  the  surveillance? 

For  example,  the  purpose  of  the  PWR  PCC  Automatic  Valve  Actuation 
surveillance  is  to  confirm  that  if  an  accident  occurs  which  requires  an  Engineered  Safety 
Feature  signal,  the  signal  flows  from  the  instrument,  to  a  signal  processor,  to  the  motor  for 
each  required  valve,  and  that  the  motor  energizes  and  positions  the  valve  within  design 
time  limits. 

•  What  could  prevent  the  system/components  from  performing  their  function,  and  are 
there  time  dependent  failure  on  the  interval  of  concern? 

This  section  does  not  require  a  detailed  failure  effect  mode  analysis  (FEMA)  but 
should  consider  the  major  ways  the  system  could  fail.  For  example,  for  the  PCC 
Automatic  Valve  Actuation  surveillance,  the  system  would  fail  to  perform  its  function  if 
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the  sensor  failed,  the  signal  path  or  logic  processor  failed,  the  motor  for  any  valve  failed, 
or  any  valve  mechanically  failed  to  operate. 

•  Are  other  surveillances  performed  on  a  more  frequent  basis  than  the  surveillance  being 
evaluated  which  confirm  the  proper  operation  of  individual  portions  of  the  system? 

For  example,  for  the  PCC  Automatic  Valve  Actuation  surveillance,  most  of  the 
valves  are  stroked,  and  the  signal  path  confirmed  on  a  quarterly  basis  to  meet  Inservice 
Testing  requirements.  The  sensors  can  be  checked  to  confirm  they  are  operating  properly 
by  comparing  redundant  channel  readings  on  operating  logs. 

•  For  any  parts  of  the  system  not  checked  on  a  more  frequent  basis  by  other 
surveillances,  would  a  time  dependent  failure  be  expected  to  occur  during  the  interval 
between  the  old  and  new  performance  intervals? 

To  evaluate  this  section  one  should  consider  the  margin  between  the  actual 
performance  of  the  system  to  its  design  basis  performance  limits,  the  operating 
environment  of  the  components,  and  whether  this  environment  would  be  expected  to 
cause  a  prompt  jump  in  failure  probability  during  the  interval  extension.  Comparing 
performance  data  from  shorter  previously  used  cycle  lengths  to  the  current  cycle  length 
may  provide  a  useful  baseline  of  any  possible  time  dependent  degradation  in  performance. 

•  What  is  the  operating  environment  of  the  system/component? 

Components  that  operate  under  high  temperature,  humidity,  or  radiation 
conditions  may  be  more  susceptible  to  time  dependent  failure  modes  on  the  interval  of 
concern  as  compared  to  other  similar  components  not  subject  to  the  same  harsh 
environmental  conditions.  The  environmental  qualification  (EQ)  of  the  components 
should  be  verified  with  system  engineers  and  EQ  personnel. 
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A.2.4.2  Performance  History 

The  performance  history  section  should  be  further  subdivided  into  four  specific 
sections. 

•  Surveillance  results 

•  Corrective  maintenance  frequency  and  type 

•  Preventative  maintenance  records 

•  System  Engineer  consultation 

A.2.4.2.a  Surveillance  results  Compile  and  review  the  results  of  all  previous 
surveillance  performances.  Evaluate  whether  these  surveillance  results  support  a 
fuel  cycle  extension.  Past  surveillance  results  as  shown  in  attachment  2  in  section 
8.2.2  may  be  obtained  through  the  individual  plant  databases. 

A.2.4.2. b  Corrective  maintenance  frequency  and  type  Compile  and  review  the 
corrective  maintenance  history  for  the  system  being  evaluated.  The  purpose  of  the 
review  is  to  identify  any  potential  failures  which  appear  to  be  of  a  time  dependent 
nature  and  which  might  be  expected  to  occur  inside  the  interval  of  concern. 

A.2.4.2. c  Preventative  Maintenance  Records  The  purpose  of  this  review  is  to 
ensure  that  there  are  no  other  preventative  maintenance  activities  performed  on  the 
system/component  with  performance  intervals  in  either  years  or  refueling  interval 
multiples  which  would  interfere  with  extending  the  surveillance  interval. 

A.2.4.2. d  System  Engineer  Consultation.  System  engineers  are  an  important 
source  of  information.  They  should  be  consulted  early  on  in  the  evaluation  process 
to  obtain  their  opinions  on  the  feasibility  of  extending  the  surveillance  performance 
interval  and  to  ensure  that  all  pertinent  sources  of  information  necessary  to 
complete  the  evaluation  are  being  used.  They  should  also  be  consulted  near  the 
end  of  the  process  to  obtain  comments  and  opinions  on  the  rough  draft  of  the 
evaluation  before  final  submittal. 
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A.2.5  Section  IV-  Significant  Hazards  Evaluation 

Complete  this  evaluation  in  accordance  with  10CFR50.92.  This  part  of  the 
evaluation  forms  the  basis  for  the  licensing  department’s  request  for  interval  extension  to 
the  NRC.  The  evaluation  must  address  the  following: 

(1)  The  proposed  change  does  not  involve  a  significant  increase  in  the  probability 
or  consequences  of  an  accident  previously  evaluated. 

(2)  The  proposed  change  does  not  create  the  possibility  of  a  new  or  different  kind 
of  accident  from  any  accident  previously  evaluated 

(3)  The  proposed  change  does  not  involve  a  significant  reduction  in  a  margin  of 
safety 

Section  5.2  of  this  report  provides  an  example  of  the  format  and  information  required  in 
this  section. 

A.2.6  Section  V  -  Sources  of  Information 

The  following  sources  of  information  should  be  used  to  complete  the  technical 
evaluation: 

•  Station  Technical  Specifications 

•  Station  Final  Safety  Analysis  Report 

•  Station  surveillance  procedures 

•  System  drawings 

•  System  engineers 

•  Environmental  Qualification  engineers 

•  Annual  System  Performance  Reports 

•  Generic  Letter  91-04  “Changes  in  Technical  Specification  Surveillance  Intervals  to 
Accommodate  a  24-Month  Fuel  Cycle” 
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Fuel  Cycle  Extension 
Technical  Evaluation  Checklist 


Failure  Mode  Analysis 

-Operating  environment  of  the  component/system  will  not  contribute  to  time 
dependent  failures 

-Potential  failure  modes  of  components  tested  by  the  surveillance  do  not 
have  time  dependent  failures  that  are  so  short  that  they  would  be  expected 
to  occur  on  the  interval  of  concern 

-Failure  probability  analyzed  based  on  plant  and  industry  data 

-Affect  of  failure  has  been  analyzed 

-Components  that  are  not  checked  by  other  surveillances  on  a  more  frequent 
basis  do  not  have  time  dependent  failure  modes  that  would  be  expected  to 
occur  on  the  interval  of  concern 

-Other  surveillances  are  performed  on  system  components  on  a  more 
frequent  basis  which  confirm  continued  component  performance 

-Is  the  component  or  system  stand  alone,  if  not,  do  support  systems 
performance  support  interval  extension? 

■ 

Performance  History  Analysis 

— 

-Results  of  past  surveillance  testing  supports 

-Corrective  maintenance  history  supports  a  conclusion  that  there  have  been 
no  failures  of  a  time  dependent  nature 

■ 

-Other  preventative  maintenance  performed  on  the  system  does  not  prevent 
interval  extension 

-System  Engineers  and  system  experts  support  the  conclusion  that  the 
surveillance  interval  can  be  safely  extended 

Plant  Data  Required 

Planned  Maintenance  History  (Tech  Spec) 

Corrective  Maintenance  History 

Planned  System  Maintenance  (Tech  Spec) 

■ 

Planned  System  Maintenance  (Non-Tech  Spec) 
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